diff options
Diffstat (limited to 'hosts')
| -rw-r--r-- | hosts/nyaan/default.nix | 3 | ||||
| -rw-r--r-- | hosts/nyaan/network.nix | 111 | ||||
| -rw-r--r-- | hosts/nyaan/wireguard.nix | 62 | ||||
| -rw-r--r-- | hosts/sagittarius/web/wireguard.nix | 4 |
4 files changed, 114 insertions, 66 deletions
diff --git a/hosts/nyaan/default.nix b/hosts/nyaan/default.nix index 5efb9a7..67de583 100644 --- a/hosts/nyaan/default.nix +++ b/hosts/nyaan/default.nix @@ -9,7 +9,7 @@ # Include the results of the hardware scan. ./hardware.nix - ./wireguard.nix + ./network.nix ./home.nix (flakeRoot + /share/system/client-common.nix) { @@ -29,7 +29,6 @@ boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.graceful = true; boot.loader.efi.canTouchEfiVariables = true; - networking.hostName = "nyaan"; time.timeZone = "Europe/Zagreb"; i18n.defaultLocale = "en_US.UTF-8"; diff --git a/hosts/nyaan/network.nix b/hosts/nyaan/network.nix new file mode 100644 index 0000000..ffacf65 --- /dev/null +++ b/hosts/nyaan/network.nix @@ -0,0 +1,111 @@ +{ config, ... }: +let + secrets = config.sops.secrets; + # NOTE: port is the same on every host + wgPort = 51820; +in +{ + sops = { + age.keyFile = "/var/lib/sops-nix/key.txt"; + secrets = { + "wg-priv-key" = { + sopsFile = ../../secrets/wg-nyaan-private.txt; + owner = "systemd-network"; + group = "systemd-network"; + mode = "0640"; + format = "binary"; + }; + "wireless.env" = { + sopsFile = ../../secrets/wireless.env; + owner = "wpa_supplicant"; + group = "wpa_supplicant"; + format = "dotenv"; + }; + }; + }; + + networking = { + hostName = "nyaan"; + firewall.allowedUDPPorts = [ wgPort ]; + useNetworkd = true; + wireless = { + enable = true; + secretsFile = secrets."wireless.env".path; + userControlled = true; + networks = { + "KopsiNet-5".pskRaw = "ext:kopsinet_psk"; + "Pixel_3139" = { + pskRaw = "ext:phone_hotspot_psk"; + hidden = true; + }; + "eduroam" = { + authProtocols = [ "WPA-EAP" ]; + auth = '' + pairwise=CCMP TKIP + eap=TTLS PEAP TLS + group=CCMP TKIP + identity="mbastaja@tvz.hr" + altsubject_match="DNS:freeradius.tvz.hr" + phase1="peaplabel=0" + phase2="auth=PAP" + password="ext:eduroam_pass" + anonymous_identity="anonymous@tvz.hr" + ''; + }; + "Students-TVZ" = { + authProtocols = [ "WPA-EAP" ]; + auth = '' + pairwise=CCMP TKIP + eap=PEAP + group=CCMP TKIP + identity="mbastaja@tvz.hr" + phase1="peaplabel=0" + phase2="auth=MSCHAPV2" + password="ext:eduroam_pass" + ''; + }; + }; + }; + }; + + systemd.network = { + enable = true; + networks."50-wg" = { + matchConfig.Name = "wg0"; + address = [ + "2301:db8:acad:a::2/128" + "192.168.23.2/32" + ]; + }; + netdevs."50-wg" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg0"; + }; + + wireguardConfig = { + ListenPort = wgPort; + PrivateKeyFile = config.sops.secrets."wg-priv-key".path; + # To automatically create routes for everything in AllowedIPs, + # add RouteTable=main + RouteTable = "main"; + # FirewallMark marks all packets send and received by wg0 with the + # number 42, which can be used to define policy rules on these packets. + FirewallMark = 42; + }; + + wireguardPeers = [ + { + # sagittarius + PublicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI="; + AllowedIPs = [ + "2301:db8:acad:a::1/128" + "192.168.23.1/32" + ]; + Endpoint = "95.216.136.85:${toString wgPort}"; + PersistentKeepalive = 1; + } + ]; + }; + }; +} diff --git a/hosts/nyaan/wireguard.nix b/hosts/nyaan/wireguard.nix deleted file mode 100644 index c8e562d..0000000 --- a/hosts/nyaan/wireguard.nix +++ /dev/null @@ -1,62 +0,0 @@ -{ config, ... }: -let - # NOTE: port is the same on every host - port = 51820; -in -{ - sops = { - age.keyFile = "/var/lib/sops-nix/key.txt"; - secrets = { - "wg-priv-key" = { - sopsFile = ../../secrets/wg-nyaan-private.txt; - owner = "systemd-network"; - group = "systemd-network"; - mode = "0640"; - format = "binary"; - }; - }; - }; - - networking.firewall.allowedUDPPorts = [ port ]; - networking.useNetworkd = true; - - systemd.network = { - enable = true; - networks."50-wg" = { - matchConfig.Name = "wg0"; - address = [ - "2301:db8:acad:a::2/128" - "192.168.5.2/32" - ]; - }; - netdevs."50-wg" = { - netdevConfig = { - Kind = "wireguard"; - Name = "wg0"; - }; - - wireguardConfig = { - ListenPort = port; - PrivateKeyFile = config.sops.secrets."wg-priv-key".path; - # To automatically create routes for everything in AllowedIPs, - # add RouteTable=main - RouteTable = "main"; - # FirewallMark marks all packets send and received by wg0 with the - # number 42, which can be used to define policy rules on these packets. - FirewallMark = 42; - }; - - wireguardPeers = [ - { - # sagittarius - PublicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0="; - AllowedIPs = [ - "2301:db8:acad:a::1/128" - "192.168.5.1/32" - ]; - Endpoint = "95.216.136.85:${toString port}"; - } - ]; - }; - }; -} diff --git a/hosts/sagittarius/web/wireguard.nix b/hosts/sagittarius/web/wireguard.nix index 7760174..a3eefc6 100644 --- a/hosts/sagittarius/web/wireguard.nix +++ b/hosts/sagittarius/web/wireguard.nix @@ -13,7 +13,7 @@ in matchConfig.Name = "wg0"; address = [ "2301:db8:acad:a::1/128" - "192.168.5.1/32" + "192.168.23.1/32" ]; }; netdevs."50-wg" = { @@ -39,7 +39,7 @@ in PublicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0="; AllowedIPs = [ "2301:db8:acad:a::2/128" - "192.168.5.2/32" + "192.168.23.2/32" ]; } ]; |