hosts/cirrus/wireguard-server.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

{ config, ... }:
{
  networking.firewall.allowedUDPPorts = [ 51820 ];
  networking.wireguard.enable = true;
  systemd.network = {
    netdevs."oxalab" = {
      netdevConfig = {
        Kind = "wireguard";
        Name = "oxalab";
        Description = "oxa's enterprise network";
      };
      wireguardConfig = {
        PrivateKeyFile = config.sops.secrets."wg/oxalab-seckey".path;
        ListenPort = 51820;
        # own pubkey: 5nCVC21BL+1r70OGwA4Q6Z/gcPLC3+ZF8sTurdn7N0E=
      };
      wireguardPeers = [
        {
          # microwave
          wireguardPeerConfig = {
          # nextcloud down, have to keep things in here: https://www.youtube.com/watch?v=1c6v7j1TUBI
          PublicKey = "0zpfcNrmbsNwwbnDDX4SMl4BVTB0zuhGKixT9TJQoHc=";
          AllowedIPs = [ "10.66.66.10/32" ];
          PersistentKeepalive = 25;
        };
        }
        {
          # Dishwasher
          wireguardPeerConfig = {
          # nextcloud down, have to keep things in here: https://www.youtube.com/watch?v=1c6v7j1TUBI
          PublicKey = "xrremJFIcxwR6snoTUK+mytjez60I91XE120OQGQ7gc=";
          AllowedIPs = [ "10.66.66.100/32" ];
          PersistentKeepalive = 25;
        };
        }
      ];
    };
    networks."oxalab" = {
      matchConfig.Name = "oxalab";
      networkConfig = {
        Address = "10.66.66.1/24";
      };
    };
  };
}