infrastructure

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README

wireguard-client.nix (3113B)

      1 {
      2   config,
      3   pkgs,
      4   lib,
      5   ...
      6 }:
      7 
      8 let
      9   cfg = config.services.local.wireguard-client;
     10 
     11   # Shared VPN host mappings
     12   defaultExtraHosts = ''
     13     10.100.0.1 poseidon
     14     10.100.0.2 thinkpad
     15     10.100.0.3 pixel
     16     10.100.0.4 gaia
     17     10.100.0.5 ipad
     18     10.100.0.6 macbook
     19     10.100.0.7 helios mail.silasbrack.com
     20     10.100.0.8 xps
     21   '';
     22 in
     23 {
     24   options.services.local.wireguard-client = {
     25     enable = lib.mkEnableOption "WireGuard VPN client";
     26 
     27     address = lib.mkOption {
     28       type = lib.types.str;
     29       description = "VPN address with CIDR (e.g., 10.100.0.4/24)";
     30     };
     31 
     32     privateKeySecretName = lib.mkOption {
     33       type = lib.types.str;
     34       description = "Name of the sops secret containing the private key";
     35     };
     36 
     37     listenPort = lib.mkOption {
     38       type = lib.types.port;
     39       default = 10232;
     40       description = "Local listen port";
     41     };
     42 
     43     autostart = lib.mkOption {
     44       type = lib.types.bool;
     45       default = true;
     46       description = "Start VPN automatically";
     47     };
     48 
     49     dns = lib.mkOption {
     50       type = lib.types.listOf lib.types.str;
     51       default = [ "10.100.0.1" ];
     52       description = "DNS servers";
     53     };
     54 
     55     serverPublicKey = lib.mkOption {
     56       type = lib.types.str;
     57       default = "2jWfr5UmACvuS+0HOfSNgEUYqoqVNnfVDoaatmgEykw=";
     58       description = "VPN server public key";
     59     };
     60 
     61     serverEndpoint = lib.mkOption {
     62       type = lib.types.str;
     63       default = "188.166.127.72:51820";
     64       description = "VPN server endpoint";
     65     };
     66 
     67     allowedIPs = lib.mkOption {
     68       type = lib.types.listOf lib.types.str;
     69       default = [ "10.100.0.0/24" ];
     70       description = "Allowed IPs to route through VPN";
     71     };
     72 
     73     routeAllTraffic = lib.mkOption {
     74       type = lib.types.bool;
     75       default = false;
     76       description = "Route all traffic through VPN (sets allowedIPs to 0.0.0.0/0)";
     77     };
     78 
     79     persistentKeepalive = lib.mkOption {
     80       type = lib.types.int;
     81       default = 25;
     82       description = "Keepalive interval in seconds";
     83     };
     84 
     85     extraHosts = lib.mkOption {
     86       type = lib.types.lines;
     87       default = defaultExtraHosts;
     88       description = "Extra /etc/hosts entries for VPN hosts";
     89     };
     90 
     91     openFirewallPort = lib.mkOption {
     92       type = lib.types.bool;
     93       default = true;
     94       description = "Open UDP port in firewall";
     95     };
     96   };
     97 
     98   config = lib.mkIf cfg.enable {
     99     sops.secrets.${cfg.privateKeySecretName} = {
    100       restartUnits = [ "wg-quick-wg0.service" ];
    101     };
    102 
    103     networking.firewall.allowedUDPPorts = lib.mkIf cfg.openFirewallPort [ cfg.listenPort ];
    104 
    105     networking.extraHosts = cfg.extraHosts;
    106 
    107     networking.wg-quick.interfaces.wg0 = {
    108       address = [ cfg.address ];
    109       dns = cfg.dns;
    110       listenPort = cfg.listenPort;
    111       autostart = cfg.autostart;
    112       privateKeyFile = "/run/secrets/${cfg.privateKeySecretName}";
    113       peers = [
    114         {
    115           publicKey = cfg.serverPublicKey;
    116           allowedIPs = if cfg.routeAllTraffic then [ "0.0.0.0/0" ] else cfg.allowedIPs;
    117           endpoint = cfg.serverEndpoint;
    118           persistentKeepalive = cfg.persistentKeepalive;
    119         }
    120       ];
    121     };
    122   };
    123 }