mircowave: use iwd, resolvd and networkmanager
This commit is contained in:
parent
ad486191bc
commit
4368fa3920
6 changed files with 179 additions and 72 deletions
|
@ -38,16 +38,13 @@
|
|||
modules = [
|
||||
sops-nix.nixosModules.sops
|
||||
home-manager.nixosModules.home-manager
|
||||
./hosts/microwave/configuration.nix
|
||||
./hosts/microwave/secrets.nix
|
||||
./hosts/microwave/hardware-configuration.nix
|
||||
./hosts/microwave
|
||||
./modules/graphical.nix
|
||||
./modules/basic-tools.nix
|
||||
./modules/gnupg.nix
|
||||
./modules/hw-accel-intel.nix
|
||||
./modules/radio.nix
|
||||
./modules/tlp.nix
|
||||
./modules/wireguard.nix
|
||||
./modules/binary-caches.nix
|
||||
./modules/science.nix
|
||||
./modules/mail.nix
|
||||
|
@ -55,7 +52,6 @@
|
|||
./modules/virtualization.nix
|
||||
({ pkgs, ... }: {
|
||||
services.throttled.enable = true;
|
||||
services.influxdb.enable = true;
|
||||
})
|
||||
({ pkgs, ... }: {
|
||||
nixpkgs.overlays = [ fenix.overlay ];
|
||||
|
|
|
@ -21,14 +21,6 @@
|
|||
element-desktop-wayland
|
||||
];
|
||||
|
||||
networking.firewall.enable = true;
|
||||
networking = {
|
||||
hostName = "microwave"; # Define your hostname.
|
||||
networkmanager.enable = true;
|
||||
wireguard.enable = true;
|
||||
|
||||
};
|
||||
|
||||
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
|
@ -65,7 +57,6 @@
|
|||
createHome = true;
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"networkmanager"
|
||||
"wireshark"
|
||||
"video"
|
||||
"libvirtd"
|
||||
|
|
9
hosts/microwave/default.nix
Normal file
9
hosts/microwave/default.nix
Normal file
|
@ -0,0 +1,9 @@
|
|||
{
|
||||
imports = [
|
||||
./configuration.nix
|
||||
./hardware-configuration.nix
|
||||
|
||||
./network.nix
|
||||
./secrets.nix
|
||||
];
|
||||
}
|
157
hosts/microwave/network.nix
Normal file
157
hosts/microwave/network.nix
Normal file
|
@ -0,0 +1,157 @@
|
|||
{ pkgs, config, ... }: {
|
||||
environment.systemPackages = with pkgs; [
|
||||
iwgtk
|
||||
];
|
||||
networking = {
|
||||
hostName = "microwave"; # Define your hostname.
|
||||
firewall.enable = true;
|
||||
useNetworkd = true;
|
||||
wireguard.enable = true;
|
||||
wireless.iwd = {
|
||||
enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
# workaround for networkd waiting for shit
|
||||
systemd.services.systemd-networkd-wait-online.serviceConfig.ExecStart = [
|
||||
"" # clear old command
|
||||
"${config.systemd.package}/lib/systemd/systemd-networkd-wait-online --any"
|
||||
];
|
||||
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
|
||||
# wait-online.ignoredInterfaces = [ "wlan0" "enp53s0" ];
|
||||
|
||||
# Interfaces on the machine
|
||||
networks."10-ether" = {
|
||||
matchConfig = { Name = "enp53s0"; };
|
||||
networkConfig = {
|
||||
DHCP = "yes";
|
||||
IPv6AcceptRA = true;
|
||||
};
|
||||
};
|
||||
networks."10-wlan" = {
|
||||
matchConfig = { Name = "wlan0"; };
|
||||
networkConfig = {
|
||||
DHCP = "yes";
|
||||
IPv6AcceptRA = true;
|
||||
IgnoreCarrierLoss = true;
|
||||
};
|
||||
};
|
||||
|
||||
# Wireguard
|
||||
# Dump-dvb
|
||||
netdevs."10-wg-dumpdvb" = {
|
||||
netdevConfig = {
|
||||
Kind = "wireguard";
|
||||
Name = "wg-dumpdvb";
|
||||
Description = "dvb.solutions enterprise network";
|
||||
};
|
||||
wireguardConfig = {
|
||||
PrivateKeyFile = config.sops.secrets."wg/wg-dvb-seckey".path;
|
||||
};
|
||||
wireguardPeers = [
|
||||
{
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "WDvCObJ0WgCCZ0ORV2q4sdXblBd8pOPZBmeWr97yphY=";
|
||||
Endpoint = "academicstrokes.com:51820";
|
||||
AllowedIPs = [ "10.13.37.0/24" ];
|
||||
PersistentKeepalive = 25;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
networks."10-wg-dumpdvb" = {
|
||||
matchConfig = { Name = "wg-dumpdvb"; };
|
||||
networkConfig = {
|
||||
Address = "10.13.37.3";
|
||||
IPv6AcceptRA = true;
|
||||
};
|
||||
routes = [
|
||||
{ routeConfig = { Gateway = "10.13.37.1"; Destination = "10.13.37.0/24"; }; }
|
||||
];
|
||||
};
|
||||
|
||||
# Dump-dvb
|
||||
netdevs."10-wg-oxalab" = {
|
||||
netdevConfig = {
|
||||
Kind = "wireguard";
|
||||
Name = "wg-oxalab";
|
||||
Description = "lab of oxa";
|
||||
};
|
||||
wireguardConfig = {
|
||||
PrivateKeyFile = config.sops.secrets."wg/oxalab-seckey".path;
|
||||
};
|
||||
wireguardPeers = [
|
||||
{
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "5nCVC21BL+1r70OGwA4Q6Z/gcPLC3+ZF8sTurdn7N0E=";
|
||||
Endpoint = "95.216.166.21:51820";
|
||||
AllowedIPs = [ "10.66.66.0/24" ];
|
||||
PersistentKeepalive = 25;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
networks."10-wg-oxalab" = {
|
||||
matchConfig = { Name = "wg-oxalab"; };
|
||||
networkConfig = {
|
||||
Address = "10.66.66.10/24";
|
||||
IPv6AcceptRA = true;
|
||||
};
|
||||
routes = [
|
||||
{ routeConfig = { Gateway = "10.66.66.1"; Destination = "10.66.66.1/24"; }; }
|
||||
];
|
||||
};
|
||||
|
||||
|
||||
# zentralwerk
|
||||
netdevs."10-wg-zentralwerk" = {
|
||||
netdevConfig = {
|
||||
Kind = "wireguard";
|
||||
Name = "wg-zentralwerk";
|
||||
Description = "Tunnel to the best basement in Dresden";
|
||||
};
|
||||
wireguardConfig = {
|
||||
PrivateKeyFile = config.sops.secrets."wg/wg-zw-seckey".path;
|
||||
};
|
||||
wireguardPeers = [
|
||||
{
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "PG2VD0EB+Oi+U5/uVMUdO5MFzn59fAck6hz8GUyLMRo=";
|
||||
Endpoint = "81.201.149.152:1337";
|
||||
AllowedIPs = [ "172.20.72.0/21" "172.22.90.0/24" ];
|
||||
PersistentKeepalive = 25;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
networks."10-wg-zentralwerk" = {
|
||||
matchConfig = { Name = "wg-zentralwerk"; };
|
||||
networkConfig = {
|
||||
Address = "172.20.76.226";
|
||||
IPv6AcceptRA = true;
|
||||
DNS = "172.20.73.8";
|
||||
};
|
||||
routes = [
|
||||
{
|
||||
routeConfig = {
|
||||
Gateway = "172.20.72.4";
|
||||
Destination = "172.20.72.0/21";
|
||||
};
|
||||
}
|
||||
{
|
||||
routeConfig = {
|
||||
Gateway = "172.20.72.4";
|
||||
Destination = "172.20.90.0/24";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
|
@ -4,9 +4,17 @@
|
|||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
|
||||
sops.secrets = {
|
||||
"wg/wg-zw-seckey" = { };
|
||||
"wg/wg-dvb-seckey" = { };
|
||||
"wg/mlwd-nl-seckey" = { };
|
||||
"wg/oxalab-seckey" = { };
|
||||
"wg/wg-zw-seckey" = {
|
||||
owner = config.users.users.systemd-network.name;
|
||||
};
|
||||
"wg/wg-dvb-seckey" = {
|
||||
owner = config.users.users.systemd-network.name;
|
||||
};
|
||||
"wg/mlwd-nl-seckey" = {
|
||||
owner = config.users.users.systemd-network.name;
|
||||
};
|
||||
"wg/oxalab-seckey" = {
|
||||
owner = config.users.users.systemd-network.name;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
@ -1,54 +0,0 @@
|
|||
{ config, ... }:
|
||||
|
||||
{
|
||||
networking.wg-quick.interfaces = {
|
||||
wg-zw = {
|
||||
privateKeyFile = config.sops.secrets."wg/wg-zw-seckey".path;
|
||||
address = [ "172.20.76.226" ];
|
||||
dns = [ "172.20.73.8" ];
|
||||
peers = [
|
||||
{
|
||||
publicKey = "PG2VD0EB+Oi+U5/uVMUdO5MFzn59fAck6hz8GUyLMRo=";
|
||||
endpoint = "81.201.149.152:1337";
|
||||
allowedIPs = [ "172.20.72.0/21" "172.22.99.0/24" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
wg-dvb = {
|
||||
privateKeyFile = config.sops.secrets."wg/wg-dvb-seckey".path;
|
||||
address = [ "10.13.37.3/32" ];
|
||||
|
||||
peers = [{
|
||||
publicKey = "WDvCObJ0WgCCZ0ORV2q4sdXblBd8pOPZBmeWr97yphY=";
|
||||
allowedIPs = [ "10.13.37.0/24" ];
|
||||
endpoint = "academicstrokes.com:51820";
|
||||
persistentKeepalive = 25;
|
||||
}];
|
||||
};
|
||||
|
||||
mlwd-nl = {
|
||||
privateKeyFile = config.sops.secrets."wg/mlwd-nl-seckey".path;
|
||||
address = [ "10.65.79.164/32" "fc00:bbbb:bbbb:bb01::2:4fa3/128" ];
|
||||
dns = [ "193.138.218.74" ];
|
||||
|
||||
peers = [{
|
||||
publicKey = "StMPmol1+QQQQCJyAkm7t+l/QYTKe5CzXUhw0I6VX14=";
|
||||
allowedIPs = [ "0.0.0.0/0" "::0/0" ];
|
||||
endpoint = "92.60.40.194:51820";
|
||||
}];
|
||||
};
|
||||
|
||||
oxalab = {
|
||||
privateKeyFile = config.sops.secrets."wg/oxalab-seckey".path;
|
||||
address = [ "10.66.66.10/32" ];
|
||||
|
||||
peers = [{
|
||||
publicKey = "5nCVC21BL+1r70OGwA4Q6Z/gcPLC3+ZF8sTurdn7N0E=";
|
||||
allowedIPs = [ "10.66.66.0/24" ];
|
||||
endpoint = "95.216.166.21:51820";
|
||||
persistentKeepalive = 25;
|
||||
}];
|
||||
};
|
||||
};
|
||||
}
|
Loading…
Add table
Reference in a new issue