From 65968fb7b1f6072424df1c396c097117e5dd7f63 Mon Sep 17 00:00:00 2001 From: Isabella Bastaja Date: Thu, 28 May 2026 17:12:58 +0200 Subject: common wireguard module --- .sops.yaml | 7 ++++ hosts/nyaan/network.nix | 67 ++++---------------------------- hosts/sagittarius/network.nix | 45 ++-------------------- secrets/wg-nyaan-private.txt | 26 ------------- secrets/wg-sagittarius-private.txt | 26 ------------- secrets/wireguard/nyaan.txt | 26 +++++++++++++ secrets/wireguard/sagittarius.txt | 26 +++++++++++++ wireguard.nix | 78 ++++++++++++++++++++++++++++++++++++++ 8 files changed, 148 insertions(+), 153 deletions(-) delete mode 100644 secrets/wg-nyaan-private.txt delete mode 100644 secrets/wg-sagittarius-private.txt create mode 100644 secrets/wireguard/nyaan.txt create mode 100644 secrets/wireguard/sagittarius.txt create mode 100644 wireguard.nix diff --git a/.sops.yaml b/.sops.yaml index 239b481..49cb169 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -11,3 +11,10 @@ creation_rules: - *machine_wonderland - *machine_sagittarius - *machine_underworld + - path_regex: secrets/wireguard/[^/]+\.(txt)$ + key_groups: + - age: + - *admin_miran + - *machine_wonderland + - *machine_sagittarius + - *machine_underworld diff --git a/hosts/nyaan/network.nix b/hosts/nyaan/network.nix index e5d39aa..ea4f9a5 100644 --- a/hosts/nyaan/network.nix +++ b/hosts/nyaan/network.nix @@ -1,32 +1,22 @@ -{ config, ... }: +{ config, flakeRoot, ... }: let secrets = config.sops.secrets; - # NOTE: port is the same on every host - wgPort = 51820; in { + imports = [ (flakeRoot + /wireguard.nix) ]; + sops = { age.keyFile = "/var/lib/sops-nix/key.txt"; - secrets = { - "wg-priv-key" = { - sopsFile = ../../secrets/wg-nyaan-private.txt; - owner = "systemd-network"; - group = "systemd-network"; - mode = "0640"; - format = "binary"; - }; - "wireless.env" = { - sopsFile = ../../secrets/wireless.env; - owner = "wpa_supplicant"; - group = "wpa_supplicant"; - format = "dotenv"; - }; + secrets."wireless.env" = { + sopsFile = ../../secrets/wireless.env; + owner = "wpa_supplicant"; + group = "wpa_supplicant"; + format = "dotenv"; }; }; networking = { hostName = "nyaan"; - firewall.allowedUDPPorts = [ wgPort ]; useNetworkd = true; wireless = { enable = true; @@ -71,45 +61,4 @@ in 2301:db8:acad:a::1 sagittarius sagittarius.local ''; }; - - systemd.network = { - enable = true; - networks."50-wg" = { - matchConfig.Name = "wg0"; - address = [ - "2301:db8:acad:a::2/128" - "192.168.23.2/32" - ]; - }; - netdevs."50-wg" = { - netdevConfig = { - Kind = "wireguard"; - Name = "wg0"; - }; - - wireguardConfig = { - ListenPort = wgPort; - PrivateKeyFile = config.sops.secrets."wg-priv-key".path; - # To automatically create routes for everything in AllowedIPs, - # add RouteTable=main - RouteTable = "main"; - # FirewallMark marks all packets send and received by wg0 with the - # number 42, which can be used to define policy rules on these packets. - FirewallMark = 42; - }; - - wireguardPeers = [ - { - # sagittarius - PublicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI="; - AllowedIPs = [ - "2301:db8:acad:a::1/128" - "192.168.23.1/32" - ]; - Endpoint = "95.216.136.85:${toString wgPort}"; - PersistentKeepalive = 1; - } - ]; - }; - }; } diff --git a/hosts/sagittarius/network.nix b/hosts/sagittarius/network.nix index 9612011..7dac324 100644 --- a/hosts/sagittarius/network.nix +++ b/hosts/sagittarius/network.nix @@ -1,15 +1,12 @@ -{ config, ... }: -let - # NOTE: port is the same on every host - wgPort = 51820; -in +{ flakeRoot, ... }: { + imports = [ (flakeRoot + /wireguard.nix) ]; + networking = { hostName = "sagittarius"; useNetworkd = true; firewall = { allowedTCPPorts = [ 22 ]; - allowedUDPPorts = [ wgPort ]; }; }; @@ -23,42 +20,6 @@ in address = [ "2a01:4f9:c012:c7a7::1/64" ]; routes = [ { Gateway = "fe80::1"; } ]; }; - "50-wg" = { - matchConfig.Name = "wg0"; - address = [ - "2301:db8:acad:a::1/128" - "192.168.23.1/32" - ]; - }; - }; - - netdevs."50-wg" = { - netdevConfig = { - Kind = "wireguard"; - Name = "wg0"; - }; - - wireguardConfig = { - ListenPort = wgPort; - PrivateKeyFile = config.sops.secrets."wg-priv-key".path; - # To automatically create routes for everything in AllowedIPs, - # add RouteTable=main - RouteTable = "main"; - # FirewallMark marks all packets send and received by wg0 with the - # number 42, which can be used to define policy rules on these packets. - FirewallMark = 42; - }; - - wireguardPeers = [ - { - # nyaan - PublicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0="; - AllowedIPs = [ - "2301:db8:acad:a::2/128" - "192.168.23.2/32" - ]; - } - ]; }; }; } diff --git a/secrets/wg-nyaan-private.txt b/secrets/wg-nyaan-private.txt deleted file mode 100644 index b555f6c..0000000 --- a/secrets/wg-nyaan-private.txt +++ /dev/null @@ -1,26 +0,0 @@ -{ - "data": "ENC[AES256_GCM,data:wvbx0vdyRV4pnyZUexK+ryiAQ4ftBu3GUfXaZY3oJVbUYPzP4eCghGaJoDcr,iv:3vbNks6l8AON8TKiVI8M4MY3X/+G7BhFhI4y1moJL08=,tag:wgVuh2/l9W6id32S0+N/fA==,type:str]", - "sops": { - "age": [ - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRUkk5VzVjZS9NU2dlaFhB\nN1FyQjdrRnpsWjNZM2hkMzFuSFdKa01IbFRFCnArQ1FvaDMwSlFab1FnSmxTdllU\nTk1CbmQ4dFJvSmVhVGZBK2NpM21VbUEKLS0tIEhUc3RDUnkwS3NFdkRYVnZKTFA3\nUUtDcWVrd2ltd083UVZlQ3RUMkNrQlEKc3dzihHvFxvB8MKsCQMpOQl/EYyQgYeA\nWIP073tRAKRzd9YNtAMi/GgTyTi1kegsmXmkt0BILyBjo00kGNLaLA==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYSTFianpCTENOWmZ4Vkl0\nMEF3WVpvN3MwSHREd2tnWTZYa3JRRldpYjFjCnNzQjdaWHVLMkpRTU9VakFua3JB\nc0NVYld5anhLWnFqOEpRRXg3c3VpdHcKLS0tIE1EZHZaN2dUZ2V6UmVGaWlja0d3\nMDBwU2JkOVpTbFNkZ01UQ2dHSzJmdGsKyPdHwEHY/c/uyg0/7OUPqdD3vEPDizOQ\nWVT5kzKETW29h9pQl7EDoLNP54gmBKtDEZ4JcY7nON4pAITS/DgeKg==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzcUlONzZCVjl3b2R5azk4\nbjhpU0hlVEo3cEFHZXVNODlremNpdTRRZm1ZCjIyV1NsZk5Sam9DUWFwQ01iY08v\nUFdkMUdiS1VFZkcxZ1d3ODdFODJpaHcKLS0tIFNmQ2xxeUlTaUhnTENwT0dCR2x5\nN2wvS3ZZd3BqeUhqWHJRcFFiRWFrNXMKUrqv6PVR1fjfugcrj+elBa04lku/bMr5\nfDC7YRGcn8TsvqzCaE3fP0oPylIF4b9CkP9o/5aQuPbhoeCM0j+3wA==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5ZnkyVjEyZ2xOblU4RFZO\nZXdrK0JBSy9aRThvTlkvVmlxeU1OUjBXRXkwCks2aCt3VkM4VG55K1dQclVHL3pn\nWTZEN2JWWkpBRkF0MzdYbU1VYnNOLzgKLS0tIFRwV2M1OXh1UnRTbTQvTHJESlE3\nbW5KRTJPenYyVUd2UVdLK3UzYS9rRVUKl36iZnE+33U8H7RaTIlJjuIQCXVRokZV\n4s9uHgh0mTXawJkAYD61Ans63v0L5jCZVbxKsgzxdDEXVdLb64XXLg==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6" - } - ], - "lastmodified": "2026-05-23T16:54:07Z", - "mac": "ENC[AES256_GCM,data:l5zPLY5e2hPl4AVQavBPYMX6UEQDcC5mNi3nmBR0LZd5YccGjRJwW5jyfT7ZPBQCfuEskzB3bfxpEWCETDcMQPtZpJpt4JXmgTOxSjxgcC3t8Sl0ZXWTPU+4Wi569agQOG3f3Y9sFKpqnADGG7EjMbCHX7WJQNu3c6h0VGNkhHI=,iv:oHB7P6+rsgQZLpblc/lqpqRpI03ebsWPWmmXDq2EvF4=,tag:/1K7/VA8fmbne+gwM0YT0g==,type:str]", - "version": "3.13.1" - } -} diff --git a/secrets/wg-sagittarius-private.txt b/secrets/wg-sagittarius-private.txt deleted file mode 100644 index 97a64ab..0000000 --- a/secrets/wg-sagittarius-private.txt +++ /dev/null @@ -1,26 +0,0 @@ -{ - "data": "ENC[AES256_GCM,data:jILnlk/Nqv5fW6cGMpM9B+ztCXfb9nUX7D/SDgsCsj70vjDEl+yFiSNApFbR,iv:kvxuOCHPLUj2r4lhoJlRoI0WeRUgmnC4SnGKdXvi5uk=,tag:sRdM9KwPEnIKP3qsPNVaMA==,type:str]", - "sops": { - "age": [ - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLVk1MWWppMlFhRHVsS1Fk\nTjQvc2JJUEUvb29WMFFpSnlpd01qcDV6bFh3CnVFQ0N4THorRWxpdFVBUHFtOEM5\neEg5UEdYOEJjSC9jeitPV1h3QzkzR00KLS0tIHJNWXY0OCs4WDRUcU1RV2t1VXVP\nVnU4b29HQmJrVE9oWEY1bTZucGwxazAKN1+B96dHXjcDfVDtGiDpvh++pQ6qqwFP\nDavnBl3whhmPGyvKEN0AugJVDbIS/SJS6y0KIaOSK23qcKVJmunfeg==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyM3BvMFJIUUVYVm4wNjBW\nWnFicXpGNDdXcllDVjl1SXhwTGcxQ2pNRTJVCjNnSzNxY0hSWElOSmFkS1B6Rk5i\nS2xYUEpZcmY1cEZSQ1RuWnAzVk0ySTQKLS0tIDNQZTluaUxCQStYd2tHdi9FQ0M5\nWTNKSFkyc0k4K0gzYytLYzBONnB6ZkkKfJWBolB91gvqPX5luDs85M9XRviKEq0v\nTyBLxqNHP4EQ0iinewhcHwoLiic1Rq4JyHZTdpnKIrCFNhFuIfmdkA==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHRnB6NFY5eXVYQVgybGha\nd0s0Rm1xLytSalFBNnBmenhjRTFIMXo5QlNJCkM5RzBTeXE2ZUYzUGplNVFqckp5\ncWoyWTAzMDB4Yi9udWJBQ0U0MjUyT0UKLS0tIHNSR1g5VzZTdWdtM3k0ZkdVVEUx\ndk1FSFk3VitoVVZXaWlJbFdvSy9xcFEKhAf4pQzlZYjnHmdG67SfLB6gzJ3oSa82\nGs4j6FPV24TOWGimsd82hGXU9p+4IJG3dFtfEHWTxSdG5f4ZmcJINQ==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern" - }, - { - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1U2FCZ0tnR1hFTlVCT1ZS\nRHRCN2UwWjBnN3J2TnE2M2l3TjQvYVZlVVd3Ci9DZ0JiWUVGLzd5QWtOc3d5RFB4\nOUZrcm9vRFB2UFN3RGxGTXNEZ3dkWTgKLS0tIGUxNnJkNDdhaUdPbE5UbDlGS3JG\nS3NDT2ZkL2JEbGc5OGs4a3pibE5OSGMKHADuSCTrVMVQ79sB4BrAlpR0XNsjT0mt\nkazjomCzCnCxfM9Vk25OKlFr2SqjI9lE2hwkZVrC99ILShrvttahFQ==\n-----END AGE ENCRYPTED FILE-----\n", - "recipient": "age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6" - } - ], - "lastmodified": "2026-05-23T16:37:46Z", - "mac": "ENC[AES256_GCM,data:Sa+tyx46Y94k9JIUSY2xR/RSvmOu3xrAtOe3tx0cx84EjfFZe67smJlPiZtOTTbylZexlNZJ8NI9f2xzBT8TnYwecqlWD6hMhlfZKHuWRgtz/h53cziyVSLmFUGpv/3i6bB3gdWhOxWNolGOvCfavHzUJbNvuwOhk7LOnB/AZ8E=,iv:M7KxR9jQI8mAsllIbtq8HpvmHeqlgxXs3SWX4fqh4NU=,tag:GUBR/N1s03H38rwryGKe4w==,type:str]", - "version": "3.13.1" - } -} diff --git a/secrets/wireguard/nyaan.txt b/secrets/wireguard/nyaan.txt new file mode 100644 index 0000000..76f636d --- /dev/null +++ b/secrets/wireguard/nyaan.txt @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:Ng3FR3cU6mjQqyOkDhk8S1HUa4sO/+exJn/B+IKMnTNtG80ZWWzy8PgFJqAg,iv:mAOZLP9PWYUNXySiclpgyo2ZSkcF0MpiUXqwtNGkPAY=,tag:MvHabqCi+bsrlNuN3CfkHw==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxOXZKYjNXWjJ2eEFQNXAw\naytCZlQ0REJuODcxZitZM2hnTmVmbGZRVnlNCmNPa3ZBcmRFcHkvY1FqQllYb2Jl\nMXR3U3lCOFl2T1V4WmJnWXFwckczR2sKLS0tIFNWUHdydFNBOGFCUmpwUUt5dkNR\nZW1qbGJqbFN0cWM2SVAycTlWeGRDeE0KjGJMYucpTHDdl6DpF4ZomyOe0N4RIy50\naLHNY1zahrw0QngMRGrRqkQO5TYwB1w9LAjaAY8A9t1UPTFv3dpayw==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPcHNxREc0Q3hUVFY4c01n\nalBZbXhnNXlnVXV3TitQK1g3TFpMeE10cFIwCkZPNWVsOHViVUlmR2pyN3BtV3Zv\nQWcreVhuUzZtVXlkQTV3Y0pSWWVFM0kKLS0tIE1aWjd6Sm56Tzduckd6eXdMTjhw\naW9JSWQyRHhJQ09PY3V4c0xNSDZ5eFEKXmOmCQoav6GJ+t3qLlKRBxcARnkfzfY+\nUiKPZlELVtIR3Ph55XVwb+FXL73KSicJxV148LxGf9Bm67zK47tKyw==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNd0VYMUQvbmFYUXFsenZP\naXI1R1hNQzI2d21BWEdhQmZ5SkdFRTVENlVVCnlNWXNPV2RVa3RPQWloa0xwOWV0\nTjFvd2J1OUF5TDd6eGx0K29WVXZmYzQKLS0tIHE4VkdLK0pJU01UQjVhc2NpSjBU\nTGFwS25hK3RHdWpKRVlMcmVaWWdDaFEKEwqGjZvO2WWrbIjp91qIh8T5OlHbhB4Y\nq8R4dMYhAiBGU/N8dFrEIZLhHVRmLamg7eipOOh+MvFXLweFhMcBqA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqUXNOUmZaY0RwTDlvRVdP\nWUJiL25jNThMMzlqYmlWMm1RM0JkNTFicFR3CnBGbEpQNTlwN2dEL1lLUEZ6T0lT\nNXRmTmlSTWIrMm9HekQ2Qm83SU1oZ0UKLS0tIEY4ODY0U2NvSUxUYWRZVXZqcjA0\nTlUrbHc1cVpsQkJzNDVZQ09BTWwzcTAK9+ybeJDwSIbHj5QmBazILaoBRRYkUE1i\n5PhvxBIvNcod05ZnTcvt3kMQMPTBe85cZQG1aaxnrIiKfVZeN8/o2Q==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6" + } + ], + "lastmodified": "2026-05-30T09:55:51Z", + "mac": "ENC[AES256_GCM,data:7eX5Kys9x65tk6+Kd0uTGgQXAoSuJnJ5V3D/eAN3gh9PrGjatc6Cqw45HPk6SqeYx7y6qCRK9ncdC3SYGX2vM2esREjQjgij9oNsKQvr7IKeb5QKB1rldwoPaWtsb6IfDnNew2nSPqaUw6R+K/hdMWKCfYFu5dGU0cbSoDH6DZ8=,iv:2YYQr7VtEnYn3UtgjovhKyCFAd3N/Xl+5+LwcPImJfo=,tag:nGTnUmabUaQUYYoeQLiNzQ==,type:str]", + "version": "3.13.1" + } +} diff --git a/secrets/wireguard/sagittarius.txt b/secrets/wireguard/sagittarius.txt new file mode 100644 index 0000000..1cef967 --- /dev/null +++ b/secrets/wireguard/sagittarius.txt @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:OgzuAef2sEzf4cC7fHmmcUcdeiODfOwBS1IQ8/hN2MyrA+NqnVWYnpj9qR2J,iv:0JbA2r55QHJ7Qj8P6W3LKseimir/tciErWTeC82ln7Q=,tag:+mikffsQpyOqGC5PnFB0gw==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvM0NZVk9mdVo0Z3pJYyty\nMVV2eXNFVDM5SEVPS3BrSXl5S3IwRHE0a21vCnBHektiZDRvNDI3ZWovSjdFVDBG\nbnRLL2piekhiS1QrUitmY0tUMG1GSncKLS0tIEhvbTh6Nm1lamRrZ3MwNyt3THJJ\naVVFbnBNdkYzb3ZaazlUWnNWdlhjZ0UK+wp/uu7Q8XYoObBWKNqn4Nm8EOUBibpH\nkgvm8KE9mMFUMIbZILlO6yqPg/ppy2gBveboVgTvRCf9XlfHPj5RUg==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5bnJ1RjM2SVpHUGtkd0Rh\nblpEK3JUdEVWKy9ZZjBobnYyL0FzSU8xRWdZCisxK3ZwNDBJL00wVVp3L3IyNU5H\nZzhsNzhIdGpPWG9ZelZXZ3hjRDF2WDgKLS0tIDNsejNLaHZ1L0FmYUFDK2tNWVFP\nMGpJRTFLUkpjOTFMRVovVVRvTEF1ckEKE7DNcRUIXSmYJEJj/J7eIlnD+6+BhDpM\nNHrrPywKyHlqG6IS8oNI3OXM6tEZC1SDJ8zrE8x5uFJb42CBCodqJg==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRejJOSnRZZXFBUHFNMTQ0\nWGsxS2R6ZHUwVVRXVThKTmg3RVZyNmxHNUVrCkk4WU9Dc0hMV0xTb3dJd2R1enpH\nd1dyWmVxZmozMDBtWFdzSTF4cXpxNmcKLS0tIFBjeElqQzgzS01YanBabWxnUUti\nOUN3Yk45bGRlbHFoMmRHL0N3R01heW8KjcmdIpfVmRGaPVUuM75h2RvhmD88VnHy\n+ToQ58jIIq2ZhwCPGYtVvlBHiZjj57fp108BqfOZfBVuZlHBCmhUyQ==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqcHh4MzF5RU51dWhuY3pV\nOTdKMFV3TjhBQk5sL25WQ2dOZTlQSndZUW00CjI1RjM0TUQxNkdreGdiWk9Ca2E3\nQ2JaOXN3RFUreDJITkFoL1dxelpob1kKLS0tIHV2QjdqcjdLS0ZnR3hCcFM5THN3\nR0VjVkw0UXdTdCsrM3dzQTc5TGVOWDAKYtZOzX9chjMRRE46d3tsjv8AGF1f1WZd\nFPSc32u0ZFrcnuQDrM/KRi1mfV8chNMSPI+521KdnqcUrBWUYn54Tw==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6" + } + ], + "lastmodified": "2026-05-30T09:56:07Z", + "mac": "ENC[AES256_GCM,data:3qOpDxLQUPGKtU4TqI5RxOPiAIUCZBdoBD97Cyj0yazqECOZya/vvPGuYa+iq8MrNTtCdN9Aa9oLnIP2VXfQRR8na2X6Isx423J17Y75g5Qujnz7Szt4Gzsazvardy6Ibuy/MSOmfBbO7PFJTP6pkpVH4ICggByON1WasusTNhw=,iv:h2OSF/uDJY2rhVFtUvPyYcyh+EqkAP38VJlT0R2clY0=,tag:XpoFAeRNxPhwTAWe+E+XPA==,type:str]", + "version": "3.13.1" + } +} diff --git a/wireguard.nix b/wireguard.nix new file mode 100644 index 0000000..04ec3bc --- /dev/null +++ b/wireguard.nix @@ -0,0 +1,78 @@ +{ config, pkgs, ... }: +let + hostname = config.networking.hostName; + conf = hosts."${hostname}"; + privateKeyPath = ./secrets/wireguard/${hostname}.txt; + + lib = pkgs.lib; + wgPort = 51820; # Common port used on all peers + firewallMark = 42; + + hosts = { + sagittarius = { + address = "2301:db8:acad:a::1/128"; + publicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI="; + endpoint = "95.216.136.85:${toString wgPort}"; + }; + nyaan = { + address = "2301:db8:acad:a::2/128"; + publicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0="; + }; + }; + + generatePeer = + hostname: values: + { + PublicKey = values.publicKey; + AllowedIPs = [ values.address ]; + } + // lib.optionalAttrs (builtins.hasAttr "endpoint" values) { + Endpoint = values.endpoint; + PersistentKeepalive = 1; + }; + generatePeers = + hostname: + let + peers = lib.attrsets.filterAttrs (k: v: k != hostname) hosts; + in + lib.attrsets.mapAttrsToList generatePeer peers; +in +{ + sops.secrets."wireguard-${hostname}-pk" = { + sopsFile = privateKeyPath; + owner = "systemd-network"; + group = "systemd-network"; + mode = "0640"; + format = "binary"; + }; + + networking.firewall.allowedUDPPorts = [ wgPort ]; + + systemd.network = { + enable = true; + networks."50-wg" = { + matchConfig.Name = "wg0"; + address = [ conf.address ]; + }; + + netdevs."50-wg" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg0"; + }; + + wireguardConfig = { + ListenPort = wgPort; + PrivateKeyFile = config.sops.secrets."wireguard-${hostname}-pk".path; + # To automatically create routes for everything in AllowedIPs, + # add RouteTable=main + RouteTable = "main"; + # FirewallMark marks all packets send and received by wg0 with the + # number, which can be used to define policy rules on these packets. + FirewallMark = firewallMark; + }; + + wireguardPeers = generatePeers hostname; + }; + }; +} -- cgit v1.3.1