diff options
| -rw-r--r-- | hosts/sagittarius/default.nix | 16 | ||||
| -rw-r--r-- | hosts/sagittarius/network.nix (renamed from hosts/sagittarius/web/wireguard.nix) | 36 | ||||
| -rw-r--r-- | hosts/sagittarius/web/default.nix | 1 |
3 files changed, 27 insertions, 26 deletions
diff --git a/hosts/sagittarius/default.nix b/hosts/sagittarius/default.nix index 2b3e3db..b9d7683 100644 --- a/hosts/sagittarius/default.nix +++ b/hosts/sagittarius/default.nix @@ -10,27 +10,13 @@ ./ssh.nix ./web ./sops.nix + ./network.nix ]; boot.loader.grub.device = "/dev/sda"; time.timeZone = "Europe/Helsinki"; environment.systemPackages = [ pkgs.rclone ]; - networking = { - hostName = "sagittarius"; - useNetworkd = true; - firewall.allowedTCPPorts = [ 22 ]; - }; - systemd.network = { - enable = true; - networks."10-wan" = { - matchConfig.Name = "enp1s0"; - networkConfig.DHCP = "ipv4"; - address = [ "2a01:4f9:c012:c7a7::1/64" ]; - routes = [ { Gateway = "fe80::1"; } ]; - }; - }; - virtualisation.podman = { enable = true; autoPrune.enable = true; diff --git a/hosts/sagittarius/web/wireguard.nix b/hosts/sagittarius/network.nix index a3eefc6..9612011 100644 --- a/hosts/sagittarius/web/wireguard.nix +++ b/hosts/sagittarius/network.nix @@ -1,21 +1,37 @@ { config, ... }: let # NOTE: port is the same on every host - port = 51820; + wgPort = 51820; in { - networking.firewall.allowedUDPPorts = [ port ]; - networking.useNetworkd = true; + networking = { + hostName = "sagittarius"; + useNetworkd = true; + firewall = { + allowedTCPPorts = [ 22 ]; + allowedUDPPorts = [ wgPort ]; + }; + }; systemd.network = { enable = true; - networks."50-wg" = { - matchConfig.Name = "wg0"; - address = [ - "2301:db8:acad:a::1/128" - "192.168.23.1/32" - ]; + + networks = { + "10-wan" = { + matchConfig.Name = "enp1s0"; + networkConfig.DHCP = "ipv4"; + address = [ "2a01:4f9:c012:c7a7::1/64" ]; + routes = [ { Gateway = "fe80::1"; } ]; + }; + "50-wg" = { + matchConfig.Name = "wg0"; + address = [ + "2301:db8:acad:a::1/128" + "192.168.23.1/32" + ]; + }; }; + netdevs."50-wg" = { netdevConfig = { Kind = "wireguard"; @@ -23,7 +39,7 @@ in }; wireguardConfig = { - ListenPort = port; + ListenPort = wgPort; PrivateKeyFile = config.sops.secrets."wg-priv-key".path; # To automatically create routes for everything in AllowedIPs, # add RouteTable=main diff --git a/hosts/sagittarius/web/default.nix b/hosts/sagittarius/web/default.nix index c789e20..2ccf36b 100644 --- a/hosts/sagittarius/web/default.nix +++ b/hosts/sagittarius/web/default.nix @@ -6,6 +6,5 @@ ./git.nix ./static.nix ./navidrome.nix - ./wireguard.nix ]; } |