36 lines
930 B
Nix
36 lines
930 B
Nix
{ lib, config, ... }:
|
|
let
|
|
cfg = config.sbruder.wireguard.home;
|
|
in
|
|
{
|
|
options = {
|
|
sbruder.wireguard.home = {
|
|
enable = lib.mkEnableOption "WireGuard tunnel wg-home";
|
|
address = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "IP(v4) address of the host";
|
|
example = "10.80.0.1";
|
|
};
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
krops.secrets.wg-home-private-key = { };
|
|
|
|
networking.wireguard.interfaces.wg-home = {
|
|
privateKeyFile = config.krops.secrets.wg-home-private-key.path;
|
|
ips = [ "${cfg.address}/24" ];
|
|
peers = [
|
|
{
|
|
allowedIPs = [ "10.80.0.0/24" ];
|
|
publicKey = "UyZRAVTIc/RMs/J+591wrA8lHU0e8dwDJJwcpRb3xQA=";
|
|
endpoint = "87.140.16.73:51820"; # IPv6 is tunneled so legacy is preferred
|
|
persistentKeepalive = 25;
|
|
}
|
|
];
|
|
};
|
|
|
|
networking.firewall.trustedInterfaces = [ "wg-home" ];
|
|
};
|
|
}
|