blob: d7de0463f665f560ac9a1811db95e43c5628474b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
|
{ config, ... }: {
networking.wireguard.enable = true;
networking.useNetworkd = true;
#oxaproxy secret
sops.defaultSopsFile = ../../secrets/news/secrets.yaml;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
sops.secrets."oxaproxy-seckey" = {
owner = config.users.users.systemd-network.name;
};
systemd.network = {
enable = true;
netdevs."10-oxaproxy" = {
netdevConfig = {
Kind = "wireguard";
Name = "oxaproxy";
Description = "oxa's enterprise reverse-proxy network";
};
wireguardConfig = {
PrivateKeyFile = config.sops.secrets."oxaproxy-seckey".path;
#own pubkey: guzNmsPcQw4EGSLU3X0SP+WPKAcoMc+xv9SLWdHV1V0=
};
wireguardPeers = [
{
# cirrus
wireguardPeerConfig = {
PublicKey = "0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM=";
AllowedIPs = [ "10.34.45.0/24" ];
Endpoint = [ "95.216.166.21:51821" ];
PersistentKeepalive = 25;
};
}
];
};
networks."10-oxaproxy" = {
matchConfig.Name = "oxaproxy";
networkConfig = {
Address = "10.34.45.102/24";
};
};
networks."111-host" = {
matchConfig.MACAddress = (builtins.elemAt config.microvm.interfaces 0).mac;
networkConfig = {
Address = "10.99.99.102/24";
};
routes = [
{
routeConfig = {
Gateway = "10.99.99.1";
Destination = "0.0.0.0/0";
Metric = 1024;
};
}
{
routeConfig = {
Gateway = "10.99.99.1";
Destination = "10.99.99.0/24";
Metric = 1024;
};
}
];
};
};
}
|
