24 lines
846 B
Nix
24 lines
846 B
Nix
# The VPN: plain NixOS WireGuard, one interface `wg0`, a full mesh built from
|
|
# ./mesh.nix. Identical on every host; the host's own entry is picked by
|
|
# `networking.hostName`.
|
|
{ config, lib, ... }:
|
|
let
|
|
mesh = import ./mesh.nix;
|
|
self = config.networking.hostName;
|
|
in
|
|
{
|
|
networking.wireguard.interfaces.wg0 = {
|
|
ips = [ "${mesh.${self}.address}/24" ];
|
|
listenPort = 51820;
|
|
# Created on the host by `wg genkey`, never in the store.
|
|
privateKeyFile = "/etc/wireguard/wg0.key";
|
|
peers = lib.mapAttrsToList (_: peer: {
|
|
inherit (peer) publicKey endpoint;
|
|
allowedIPs = [ "${peer.address}/32" ];
|
|
persistentKeepalive = 25;
|
|
}) (removeAttrs mesh [ self ]);
|
|
};
|
|
|
|
# The handshake arrives on the public interface.
|
|
networking.firewall.allowedUDPPorts = [ config.networking.wireguard.interfaces.wg0.listenPort ];
|
|
}
|