39 lines
991 B
Nix
39 lines
991 B
Nix
|
{ config, lib, pkgs, ... }:
|
||
|
|
|
||
|
|
let
|
||
|
|
me = config.network.nodes.${config.network.node};
|
||
|
|
in
|
||
|
|
{
|
||
|
|
networking = {
|
||
|
|
firewall = {
|
||
|
|
allowedUDPPorts = [ 51820 ];
|
||
|
|
trustedInterfaces = [ "wg0" ];
|
||
|
|
};
|
||
|
|
wireguard.interfaces."wg0" = {
|
||
|
|
ips = [ "${me.address-vpn}/24" ];
|
||
|
|
listenPort = 51820;
|
||
|
|
generatePrivateKeyFile = true;
|
||
|
|
privateKeyFile = "/var/lib/wireguard/wg0.key";
|
||
|
|
peers = lib.mapAttrsToList (name: peer: {
|
||
|
|
publicKey = peer.vpn;
|
||
|
|
allowedIPs =
|
||
|
|
if config.network.node == "vps"
|
||
|
|
then [ "${peer.address-vpn}/32" ]
|
||
|
|
else [ "10.0.0.0/24" ];
|
||
|
|
endpoint =
|
||
|
|
if peer.address-pub != null
|
||
|
|
then "${peer.address-pub}:51820"
|
||
|
|
else null;
|
||
|
|
persistentKeepalive =
|
||
|
|
if peer.address-pub != null
|
||
|
|
then 25
|
||
|
|
else null;
|
||
|
|
}) (lib.filterAttrs (name: _:
|
||
|
|
if config.network.node == "vps"
|
||
|
|
then name != "vps"
|
||
|
|
else name == "vps"
|
||
|
|
) config.network.nodes);
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|