Noratrieb/vps
1
0
Fork 0
mirror of https://github.com/Noratrieb/vps.git synced 2026-01-14 16:55:00 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

dynamic wireguard mesh

Browse source
This commit is contained in:
nora 2024-07-31 20:17:10 +02:00
parent cfe47e65c0
commit 478b587a41
2 changed files with 36 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

52
newinfra/nix/hive.nix
View file

@ -16,16 +16,24 @@
dns2 = { dns2 = {
publicIPv4 = "128.140.3.7"; publicIPv4 = "128.140.3.7";
publicIPv6 = "2a01:4f8:c2c:d616::"; publicIPv6 = "2a01:4f8:c2c:d616::";
}; };
vps1 = { vps1 = {
publicIPv4 = "161.97.165.1"; publicIPv4 = "161.97.165.1";
publicIPv6 = null; publicIPv6 = null;
wg = {
privateIP = "10.0.0.1";
publicKey = "5tg3w/TiCuCeKIBJCd6lHUeNjGEA76abT1OXnhNVyFQ=";
peers = [ "vps3" ];
};
}; };
vps3 = { vps3 = {
publicIPv4 = "134.255.181.139"; publicIPv4 = "134.255.181.139";
publicIPv6 = null; publicIPv6 = null;
wg = {
privateIP = "10.0.0.3";
publicKey = "pdUxG1vhmYraKzIIEFxTRAMhGwGztBL/Ly5icJUV3g0=";
peers = [ "vps1" ];
};
}; };
}; };
}; };
@ -117,26 +125,6 @@
deployment.tags = [ "ingress" "eu" "apps" "wg" ]; deployment.tags = [ "ingress" "eu" "apps" "wg" ];
system.stateVersion = "23.11"; system.stateVersion = "23.11";
# TODO: move
age.secrets.wg_private.file = ./secrets/wg_private_vps1.age;
networking.wg-quick.interfaces = {
wg0 = {
address = [ "10.0.0.1/24" ];
listenPort = 51820;
privateKeyFile = config.age.secrets.wg_private.path;
peers = [
{
publicKey = "pdUxG1vhmYraKzIIEFxTRAMhGwGztBL/Ly5icJUV3g0=";
endpoint = "vps3.infra.noratrieb.dev:51820";
allowedIPs = [ "10.0.0.3/32" ];
# TODO: Use PSK
}
];
};
};
}; };
vps3 = { name, nodes, modulesPath, config, ... }: { vps3 = { name, nodes, modulesPath, config, ... }: {
imports = [ imports = [
@ -147,25 +135,5 @@
deployment.tags = [ "eu" "apps" "wg" ]; deployment.tags = [ "eu" "apps" "wg" ];
system.stateVersion = "23.11"; system.stateVersion = "23.11";
# TODO: move
age.secrets.wg_private.file = ./secrets/wg_private_vps3.age;
networking.wg-quick.interfaces = {
wg0 = {
address = [ "10.0.0.3/24" ];
listenPort = 51820;
privateKeyFile = config.age.secrets.wg_private.path;
peers = [
{
publicKey = "5tg3w/TiCuCeKIBJCd6lHUeNjGEA76abT1OXnhNVyFQ=";
endpoint = "vps1.infra.noratrieb.dev:51820";
allowedIPs = [ "10.0.0.1/32" ];
# TODO: Use PSK
}
];
};
};
}; };
} }

27
newinfra/nix/modules/wg-mesh/default.nix
View file

@ -1,7 +1,32 @@
{ ... }: { { name, config, networkingConfig, ... }:
let
wgSettings = (builtins.getAttr name networkingConfig).wg;
listenPort = 51820;
in
{
# TODO: put the actual setup here. # TODO: put the actual setup here.
networking.hosts = { networking.hosts = {
"10.0.0.1" = [ "vps1.local" ]; "10.0.0.1" = [ "vps1.local" ];
"10.0.0.3" = [ "vps3.local" ]; "10.0.0.3" = [ "vps3.local" ];
}; };
age.secrets.wg_private.file = ../../secrets/wg_private_${name}.age;
networking.wg-quick.interfaces = {
wg0 = {
address = [ "${wgSettings.privateIP}/24" ];
inherit listenPort;
privateKeyFile = config.age.secrets.wg_private.path;
peers = map
(peer:
let peerConfig = (builtins.getAttr peer networkingConfig).wg;
in {
inherit (peerConfig) publicKey;
endpoint = "${peer}.infra.noratrieb.dev:${toString listenPort}";
allowedIPs = [ "${peerConfig.privateIP}/32" ];
}
)
wgSettings.peers;
};
};
} }