set up wireguard

1 files changed, 111 insertions, 0 deletions

diff --git a/hosts/nyaan/network.nix b/hosts/nyaan/network.nix
new file mode 100644
index 0000000..ffacf65
--- /dev/null
+++ b/hosts/nyaan/network.nix
@@ -0,0 +1,111 @@
+{ config, ... }:
+let
+  secrets = config.sops.secrets;
+  # NOTE: port is the same on every host
+  wgPort = 51820;
+in
+{
+  sops = {
+    age.keyFile = "/var/lib/sops-nix/key.txt";
+    secrets = {
+      "wg-priv-key" = {
+        sopsFile = ../../secrets/wg-nyaan-private.txt;
+        owner = "systemd-network";
+        group = "systemd-network";
+        mode = "0640";
+        format = "binary";
+      };
+      "wireless.env" = {
+        sopsFile = ../../secrets/wireless.env;
+        owner = "wpa_supplicant";
+        group = "wpa_supplicant";
+        format = "dotenv";
+      };
+    };
+  };
+
+  networking = {
+    hostName = "nyaan";
+    firewall.allowedUDPPorts = [ wgPort ];
+    useNetworkd = true;
+    wireless = {
+      enable = true;
+      secretsFile = secrets."wireless.env".path;
+      userControlled = true;
+      networks = {
+        "KopsiNet-5".pskRaw = "ext:kopsinet_psk";
+        "Pixel_3139" = {
+          pskRaw = "ext:phone_hotspot_psk";
+          hidden = true;
+        };
+        "eduroam" = {
+          authProtocols = [ "WPA-EAP" ];
+          auth = ''
+            pairwise=CCMP TKIP
+            eap=TTLS PEAP TLS
+            group=CCMP TKIP
+            identity="mbastaja@tvz.hr"
+            altsubject_match="DNS:freeradius.tvz.hr"
+            phase1="peaplabel=0"
+            phase2="auth=PAP"
+            password="ext:eduroam_pass"
+            anonymous_identity="anonymous@tvz.hr"
+          '';
+        };
+        "Students-TVZ" = {
+          authProtocols = [ "WPA-EAP" ];
+          auth = ''
+            pairwise=CCMP TKIP
+            eap=PEAP
+            group=CCMP TKIP
+            identity="mbastaja@tvz.hr"
+            phase1="peaplabel=0"
+            phase2="auth=MSCHAPV2"
+            password="ext:eduroam_pass"
+          '';
+        };
+      };
+    };
+  };
+
+  systemd.network = {
+    enable = true;
+    networks."50-wg" = {
+      matchConfig.Name = "wg0";
+      address = [
+        "2301:db8:acad:a::2/128"
+        "192.168.23.2/32"
+      ];
+    };
+    netdevs."50-wg" = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "wg0";
+      };
+
+      wireguardConfig = {
+        ListenPort = wgPort;
+        PrivateKeyFile = config.sops.secrets."wg-priv-key".path;
+        # To automatically create routes for everything in AllowedIPs,
+        # add RouteTable=main
+        RouteTable = "main";
+        # FirewallMark marks all packets send and received by wg0 with the
+        # number 42, which can be used to define policy rules on these packets.
+        FirewallMark = 42;
+      };
+
+      wireguardPeers = [
+        {
+          # sagittarius
+          PublicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI=";
+          AllowedIPs = [
+            "2301:db8:acad:a::1/128"
+            "192.168.23.1/32"
+          ];
+          Endpoint = "95.216.136.85:${toString wgPort}";
+          PersistentKeepalive = 1;
+        }
+      ];
+    };
+  };
+}