commit 257a8ff4db0149a892b8a2fc9aa7406c47d64ef8
parent 506b9bfaf7fac0cf0d8e79d2403e1a79af77cbfb
Author: Silas Brack <silasbrack@gmail.com>
Date: Tue, 7 Apr 2026 12:16:01 +0200
chore: clean up, move vpn into digitalocean config
Diffstat:
4 files changed, 84 insertions(+), 87 deletions(-)
diff --git a/flake.nix b/flake.nix
@@ -52,7 +52,7 @@
in
pkgs.mkShell {
buildInputs = with pkgs; [
- git
+ git
gnumake
age
curl
diff --git a/nixos/configuration-debian-2gb-hel1-1.nix b/nixos/configuration-debian-2gb-hel1-1.nix
@@ -58,7 +58,7 @@
imports = [
# ./simple-web-app.nix
- # ./vpn.nix
+
# (builtins.fetchTarball {
# # Pick a release version you are interested in and set its hash, e.g.
# url = "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver/-/archive/nixos-25.05/nixos-mailserver-nixos-25.05.tar.gz";
diff --git a/nixos/configuration-nixos-s-1vcpu-512mb-10gb-ams3-01.nix b/nixos/configuration-nixos-s-1vcpu-512mb-10gb-ams3-01.nix
@@ -39,7 +39,6 @@
imports = [
(modulesPath + "/virtualisation/digital-ocean-image.nix")
- ./vpn.nix
];
sops.defaultSopsFile = ../secrets.yaml;
@@ -49,6 +48,88 @@
restartUnits = [ "wg-quick-wg0.service" ];
};
+ # VPN
+ networking.nat = {
+ enable = true;
+ externalInterface = "eth0";
+ internalInterfaces = [ "wg0" ];
+ };
+ # Port 53 for DNS, port 51820 for WireGuard
+ networking.firewall = {
+ allowedTCPPorts = [ 53 ];
+ allowedUDPPorts = [
+ 53
+ 51820
+ ];
+ };
+ services.dnsmasq = {
+ enable = true;
+ settings = {
+ interface = "wg0";
+ };
+ };
+ networking.wg-quick.interfaces = {
+ wg0 = {
+ address = [ "10.100.0.1/24" ];
+ listenPort = 51820;
+ privateKeyFile = "/run/secrets/server_wireguard_key";
+
+ postUp = ''
+ ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o eth0 -j ACCEPT
+ ${pkgs.iptables}/bin/iptables -A FORWARD -o wg0 -i eth0 -j ACCEPT
+ ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.1/24 -j MASQUERADE
+ '';
+ preDown = ''
+ ${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -o eth0 -j ACCEPT
+ ${pkgs.iptables}/bin/iptables -D FORWARD -o wg0 -i eth0 -j ACCEPT
+ ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.1/24 -j MASQUERADE
+ '';
+
+ peers = [
+ {
+ # Thinkpad
+ publicKey = "3owbBawNk7IEI8sHmJjr+Wna7QH5WxYuRGjU+OP4i2M=";
+ allowedIPs = [ "10.100.0.2/32" ];
+ }
+ {
+ # Pixel
+ publicKey = "pTuUtRphmXYKhwInaCIQY7nXRgftNzgKJxleACutrFc=";
+ allowedIPs = [ "10.100.0.3/32" ];
+ }
+ {
+ # Desktop
+ publicKey = "F/UODKJ2SQaRUOb7my2LtvRaN4p/khfW8bstO+09/zo=";
+ allowedIPs = [ "10.100.0.4/32" ];
+ }
+ {
+ # iPad
+ publicKey = "KwQo8pMz0JYHaEV3sbezmpD8jwgbXjaumIKeqWYaeiE=";
+ allowedIPs = [ "10.100.0.5/32" ];
+ }
+ {
+ # Lolo's Macbook Pro
+ publicKey = "qmch+NjlcVOxBcOsfwk2SJIcpN58i54131OS9J2yvmM=";
+ allowedIPs = [ "10.100.0.6/32" ];
+ }
+ {
+ # Hetzner server
+ publicKey = "QE4UoW2vSQMX8o1liA4MSwe4fE5sUB0+Ari5a/CqkSc=";
+ allowedIPs = [ "10.100.0.7/32" ];
+ }
+ {
+ # XPS 13
+ publicKey = "ZkRCc3EpJYl0EmRBEAjf9WXCW0JQvlzeq5h7fUn5aEs=";
+ allowedIPs = [ "10.100.0.8/32" ];
+ }
+ {
+ # Work Macbook pro
+ publicKey = "j+5aLHMTUGQyyjmU55ibA+JXC0pmEvQgQIOOfdMEQUA=";
+ allowedIPs = [ "10.100.0.9/32" ];
+ }
+ ];
+ };
+ };
+
users.users = {
silas = {
isNormalUser = true;
diff --git a/nixos/vpn.nix b/nixos/vpn.nix
@@ -1,84 +0,0 @@
-{ pkgs, ... }:
-
-{
- networking.nat = {
- enable = true;
- externalInterface = "eth0";
- internalInterfaces = [ "wg0" ];
- };
- # Port 53 for DNS, port 51820 for WireGuard
- networking.firewall = {
- allowedTCPPorts = [ 53 ];
- allowedUDPPorts = [
- 53
- 51820
- ];
- };
- services.dnsmasq = {
- enable = true;
- settings = {
- interface = "wg0";
- };
- };
- networking.wg-quick.interfaces = {
- wg0 = {
- address = [ "10.100.0.1/24" ];
- listenPort = 51820;
- privateKeyFile = "/run/secrets/server_wireguard_key";
-
- postUp = ''
- ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o eth0 -j ACCEPT
- ${pkgs.iptables}/bin/iptables -A FORWARD -o wg0 -i eth0 -j ACCEPT
- ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.1/24 -j MASQUERADE
- '';
- preDown = ''
- ${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -o eth0 -j ACCEPT
- ${pkgs.iptables}/bin/iptables -D FORWARD -o wg0 -i eth0 -j ACCEPT
- ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.1/24 -j MASQUERADE
- '';
-
- peers = [
- {
- # Thinkpad
- publicKey = "3owbBawNk7IEI8sHmJjr+Wna7QH5WxYuRGjU+OP4i2M=";
- allowedIPs = [ "10.100.0.2/32" ];
- }
- {
- # Pixel
- publicKey = "pTuUtRphmXYKhwInaCIQY7nXRgftNzgKJxleACutrFc=";
- allowedIPs = [ "10.100.0.3/32" ];
- }
- {
- # Desktop
- publicKey = "F/UODKJ2SQaRUOb7my2LtvRaN4p/khfW8bstO+09/zo=";
- allowedIPs = [ "10.100.0.4/32" ];
- }
- {
- # iPad
- publicKey = "KwQo8pMz0JYHaEV3sbezmpD8jwgbXjaumIKeqWYaeiE=";
- allowedIPs = [ "10.100.0.5/32" ];
- }
- {
- # Lolo's Macbook Pro
- publicKey = "qmch+NjlcVOxBcOsfwk2SJIcpN58i54131OS9J2yvmM=";
- allowedIPs = [ "10.100.0.6/32" ];
- }
- {
- # Hetzner server
- publicKey = "QE4UoW2vSQMX8o1liA4MSwe4fE5sUB0+Ari5a/CqkSc=";
- allowedIPs = [ "10.100.0.7/32" ];
- }
- {
- # XPS 13
- publicKey = "ZkRCc3EpJYl0EmRBEAjf9WXCW0JQvlzeq5h7fUn5aEs=";
- allowedIPs = [ "10.100.0.8/32" ];
- }
- {
- # Work Macbook pro
- publicKey = "j+5aLHMTUGQyyjmU55ibA+JXC0pmEvQgQIOOfdMEQUA=";
- allowedIPs = [ "10.100.0.9/32" ];
- }
- ];
- };
- };
-}
