From ff57ba7ef989b8c6828dffddf06eea1f15866f92 Mon Sep 17 00:00:00 2001 From: Isabella Morgana Bastaja Date: Sat, 23 May 2026 19:00:22 +0200 Subject: WIP: create wireguard network --- hosts/nyaan/default.nix | 1 + hosts/nyaan/wireguard.nix | 62 +++++++++++++++++++++++++++++++++++++ hosts/sagittarius/sops.nix | 7 +++++ hosts/sagittarius/web/default.nix | 1 + hosts/sagittarius/web/wireguard.nix | 48 ++++++++++++++++++++++++++++ secrets/wg-nyaan-private.txt | 26 ++++++++++++++++ secrets/wg-sagittarius-private.txt | 26 ++++++++++++++++ 7 files changed, 171 insertions(+) create mode 100644 hosts/nyaan/wireguard.nix create mode 100644 hosts/sagittarius/web/wireguard.nix create mode 100644 secrets/wg-nyaan-private.txt create mode 100644 secrets/wg-sagittarius-private.txt diff --git a/hosts/nyaan/default.nix b/hosts/nyaan/default.nix index af37dbc..d8c2291 100644 --- a/hosts/nyaan/default.nix +++ b/hosts/nyaan/default.nix @@ -9,6 +9,7 @@ # Include the results of the hardware scan. ./hardware.nix + ./wireguard.nix ./home.nix (flakeRoot + /share/system/client-common.nix) { diff --git a/hosts/nyaan/wireguard.nix b/hosts/nyaan/wireguard.nix new file mode 100644 index 0000000..a154f5b --- /dev/null +++ b/hosts/nyaan/wireguard.nix @@ -0,0 +1,62 @@ +{ config, ... }: +let + # NOTE: port is the same on every host + port = 51820; +in +{ + sops = { + age.keyFile = "/var/lib/sops-nix/key.txt"; + secrets = { + "wg-priv-key" = { + sopsFile = ../../secrets/wg-nyaan-private.txt; + owner = "systemd-networkd"; + group = "systemd-networkd"; + mode = "0640"; + format = "binary"; + }; + }; + }; + + networking.firewall.allowedUDPPorts = [ port ]; + networking.useNetworkd = true; + + systemd.network = { + enable = true; + networks."50-wg" = { + matchConfig.Name = "wg0"; + address = [ + "2301:db8:acad:a::2/128" + "192.168.5.2/32" + ]; + }; + netdevs."50-wg" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg0"; + }; + + wireguardConfig = { + ListenPort = port; + PrivateKeyFile = config.sops.secrets."wg-priv-key".path; + # To automatically create routes for everything in AllowedIPs, + # add RouteTable=main + RouteTable = "main"; + # FirewallMark marks all packets send and received by wg0 with the + # number 42, which can be used to define policy rules on these packets. + FirewallMark = 42; + }; + + wireguardPeers = [ + { + # sagittarius + PublicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0="; + AllowedIPs = [ + "2301:db8:acad:a::1/128" + "192.168.5.1/32" + ]; + Endpoint = "95.216.136.85:${port}"; + } + ]; + }; + }; +} diff --git a/hosts/sagittarius/sops.nix b/hosts/sagittarius/sops.nix index 7ba7536..22f8eb2 100644 --- a/hosts/sagittarius/sops.nix +++ b/hosts/sagittarius/sops.nix @@ -18,6 +18,13 @@ owner = "nginx"; format = "binary"; }; + "wg-priv-key" = { + sopsFile = ../../secrets/wg-sagittarius-private.txt; + owner = "systemd-networkd"; + group = "systemd-networkd"; + mode = "0640"; + format = "binary"; + }; }; }; } diff --git a/hosts/sagittarius/web/default.nix b/hosts/sagittarius/web/default.nix index 2ccf36b..c789e20 100644 --- a/hosts/sagittarius/web/default.nix +++ b/hosts/sagittarius/web/default.nix @@ -6,5 +6,6 @@ ./git.nix ./static.nix ./navidrome.nix + ./wireguard.nix ]; } diff --git a/hosts/sagittarius/web/wireguard.nix b/hosts/sagittarius/web/wireguard.nix new file mode 100644 index 0000000..7760174 --- /dev/null +++ b/hosts/sagittarius/web/wireguard.nix @@ -0,0 +1,48 @@ +{ config, ... }: +let + # NOTE: port is the same on every host + port = 51820; +in +{ + networking.firewall.allowedUDPPorts = [ port ]; + networking.useNetworkd = true; + + systemd.network = { + enable = true; + networks."50-wg" = { + matchConfig.Name = "wg0"; + address = [ + "2301:db8:acad:a::1/128" + "192.168.5.1/32" + ]; + }; + netdevs."50-wg" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg0"; + }; + + wireguardConfig = { + ListenPort = port; + PrivateKeyFile = config.sops.secrets."wg-priv-key".path; + # To automatically create routes for everything in AllowedIPs, + # add RouteTable=main + RouteTable = "main"; + # FirewallMark marks all packets send and received by wg0 with the + # number 42, which can be used to define policy rules on these packets. + FirewallMark = 42; + }; + + wireguardPeers = [ + { + # nyaan + PublicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0="; + AllowedIPs = [ + "2301:db8:acad:a::2/128" + "192.168.5.2/32" + ]; + } + ]; + }; + }; +} diff --git a/secrets/wg-nyaan-private.txt b/secrets/wg-nyaan-private.txt new file mode 100644 index 0000000..b555f6c --- /dev/null +++ b/secrets/wg-nyaan-private.txt @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:wvbx0vdyRV4pnyZUexK+ryiAQ4ftBu3GUfXaZY3oJVbUYPzP4eCghGaJoDcr,iv:3vbNks6l8AON8TKiVI8M4MY3X/+G7BhFhI4y1moJL08=,tag:wgVuh2/l9W6id32S0+N/fA==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRUkk5VzVjZS9NU2dlaFhB\nN1FyQjdrRnpsWjNZM2hkMzFuSFdKa01IbFRFCnArQ1FvaDMwSlFab1FnSmxTdllU\nTk1CbmQ4dFJvSmVhVGZBK2NpM21VbUEKLS0tIEhUc3RDUnkwS3NFdkRYVnZKTFA3\nUUtDcWVrd2ltd083UVZlQ3RUMkNrQlEKc3dzihHvFxvB8MKsCQMpOQl/EYyQgYeA\nWIP073tRAKRzd9YNtAMi/GgTyTi1kegsmXmkt0BILyBjo00kGNLaLA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYSTFianpCTENOWmZ4Vkl0\nMEF3WVpvN3MwSHREd2tnWTZYa3JRRldpYjFjCnNzQjdaWHVLMkpRTU9VakFua3JB\nc0NVYld5anhLWnFqOEpRRXg3c3VpdHcKLS0tIE1EZHZaN2dUZ2V6UmVGaWlja0d3\nMDBwU2JkOVpTbFNkZ01UQ2dHSzJmdGsKyPdHwEHY/c/uyg0/7OUPqdD3vEPDizOQ\nWVT5kzKETW29h9pQl7EDoLNP54gmBKtDEZ4JcY7nON4pAITS/DgeKg==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzcUlONzZCVjl3b2R5azk4\nbjhpU0hlVEo3cEFHZXVNODlremNpdTRRZm1ZCjIyV1NsZk5Sam9DUWFwQ01iY08v\nUFdkMUdiS1VFZkcxZ1d3ODdFODJpaHcKLS0tIFNmQ2xxeUlTaUhnTENwT0dCR2x5\nN2wvS3ZZd3BqeUhqWHJRcFFiRWFrNXMKUrqv6PVR1fjfugcrj+elBa04lku/bMr5\nfDC7YRGcn8TsvqzCaE3fP0oPylIF4b9CkP9o/5aQuPbhoeCM0j+3wA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5ZnkyVjEyZ2xOblU4RFZO\nZXdrK0JBSy9aRThvTlkvVmlxeU1OUjBXRXkwCks2aCt3VkM4VG55K1dQclVHL3pn\nWTZEN2JWWkpBRkF0MzdYbU1VYnNOLzgKLS0tIFRwV2M1OXh1UnRTbTQvTHJESlE3\nbW5KRTJPenYyVUd2UVdLK3UzYS9rRVUKl36iZnE+33U8H7RaTIlJjuIQCXVRokZV\n4s9uHgh0mTXawJkAYD61Ans63v0L5jCZVbxKsgzxdDEXVdLb64XXLg==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6" + } + ], + "lastmodified": "2026-05-23T16:54:07Z", + "mac": "ENC[AES256_GCM,data:l5zPLY5e2hPl4AVQavBPYMX6UEQDcC5mNi3nmBR0LZd5YccGjRJwW5jyfT7ZPBQCfuEskzB3bfxpEWCETDcMQPtZpJpt4JXmgTOxSjxgcC3t8Sl0ZXWTPU+4Wi569agQOG3f3Y9sFKpqnADGG7EjMbCHX7WJQNu3c6h0VGNkhHI=,iv:oHB7P6+rsgQZLpblc/lqpqRpI03ebsWPWmmXDq2EvF4=,tag:/1K7/VA8fmbne+gwM0YT0g==,type:str]", + "version": "3.13.1" + } +} diff --git a/secrets/wg-sagittarius-private.txt b/secrets/wg-sagittarius-private.txt new file mode 100644 index 0000000..97a64ab --- /dev/null +++ b/secrets/wg-sagittarius-private.txt @@ -0,0 +1,26 @@ +{ + "data": "ENC[AES256_GCM,data:jILnlk/Nqv5fW6cGMpM9B+ztCXfb9nUX7D/SDgsCsj70vjDEl+yFiSNApFbR,iv:kvxuOCHPLUj2r4lhoJlRoI0WeRUgmnC4SnGKdXvi5uk=,tag:sRdM9KwPEnIKP3qsPNVaMA==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLVk1MWWppMlFhRHVsS1Fk\nTjQvc2JJUEUvb29WMFFpSnlpd01qcDV6bFh3CnVFQ0N4THorRWxpdFVBUHFtOEM5\neEg5UEdYOEJjSC9jeitPV1h3QzkzR00KLS0tIHJNWXY0OCs4WDRUcU1RV2t1VXVP\nVnU4b29HQmJrVE9oWEY1bTZucGwxazAKN1+B96dHXjcDfVDtGiDpvh++pQ6qqwFP\nDavnBl3whhmPGyvKEN0AugJVDbIS/SJS6y0KIaOSK23qcKVJmunfeg==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyM3BvMFJIUUVYVm4wNjBW\nWnFicXpGNDdXcllDVjl1SXhwTGcxQ2pNRTJVCjNnSzNxY0hSWElOSmFkS1B6Rk5i\nS2xYUEpZcmY1cEZSQ1RuWnAzVk0ySTQKLS0tIDNQZTluaUxCQStYd2tHdi9FQ0M5\nWTNKSFkyc0k4K0gzYytLYzBONnB6ZkkKfJWBolB91gvqPX5luDs85M9XRviKEq0v\nTyBLxqNHP4EQ0iinewhcHwoLiic1Rq4JyHZTdpnKIrCFNhFuIfmdkA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHRnB6NFY5eXVYQVgybGha\nd0s0Rm1xLytSalFBNnBmenhjRTFIMXo5QlNJCkM5RzBTeXE2ZUYzUGplNVFqckp5\ncWoyWTAzMDB4Yi9udWJBQ0U0MjUyT0UKLS0tIHNSR1g5VzZTdWdtM3k0ZkdVVEUx\ndk1FSFk3VitoVVZXaWlJbFdvSy9xcFEKhAf4pQzlZYjnHmdG67SfLB6gzJ3oSa82\nGs4j6FPV24TOWGimsd82hGXU9p+4IJG3dFtfEHWTxSdG5f4ZmcJINQ==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1U2FCZ0tnR1hFTlVCT1ZS\nRHRCN2UwWjBnN3J2TnE2M2l3TjQvYVZlVVd3Ci9DZ0JiWUVGLzd5QWtOc3d5RFB4\nOUZrcm9vRFB2UFN3RGxGTXNEZ3dkWTgKLS0tIGUxNnJkNDdhaUdPbE5UbDlGS3JG\nS3NDT2ZkL2JEbGc5OGs4a3pibE5OSGMKHADuSCTrVMVQ79sB4BrAlpR0XNsjT0mt\nkazjomCzCnCxfM9Vk25OKlFr2SqjI9lE2hwkZVrC99ILShrvttahFQ==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6" + } + ], + "lastmodified": "2026-05-23T16:37:46Z", + "mac": "ENC[AES256_GCM,data:Sa+tyx46Y94k9JIUSY2xR/RSvmOu3xrAtOe3tx0cx84EjfFZe67smJlPiZtOTTbylZexlNZJ8NI9f2xzBT8TnYwecqlWD6hMhlfZKHuWRgtz/h53cziyVSLmFUGpv/3i6bB3gdWhOxWNolGOvCfavHzUJbNvuwOhk7LOnB/AZ8E=,iv:M7KxR9jQI8mAsllIbtq8HpvmHeqlgxXs3SWX4fqh4NU=,tag:GUBR/N1s03H38rwryGKe4w==,type:str]", + "version": "3.13.1" + } +} -- cgit v1.3.1