DerGrumpf/cyper-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Setup Wireguard configuration

Browse Source
This commit is contained in:
DerGrumpf
2026-06-29 11:24:19 +02:00
parent 23ecd70457
commit cbfb1fef0e
13 changed files with 144 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
darwin/default.nix
+1
View File
@@ -8,6 +8,7 @@
./settings.nix
./homebrew.nix
./yabai.nix
./wireguard.nix
];
# nix config
darwin/wireguard.nix
+40
View File
@@ -0,0 +1,40 @@
{
config,
pkgs,
hostName,
...
}:
{
sops.secrets."wireguard/${hostName}" = {
mode = "0400";
};
launchd.daemons.wireguard = {
script = ''
set -e
mkdir -p /etc/wireguard
PRIVATE_KEY=$(cat ${config.sops.secrets."wireguard/${hostName}".path})
cat > /etc/wireguard/wg0.conf << EOF
[Interface]
Address = $WG_IP
PrivateKey = $PRIVATE_KEY
[Peer]
PublicKey = NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=
Endpoint = 178.254.8.35:51820
AllowedIPs = 10.10.0.0/24
PersistentKeepalive = 25
EOF
chmod 600 /etc/wireguard/wg0.conf
${pkgs.wireguard-tools}/bin/wg-quick up wg0
'';
environment.WG_IP = "";
serviceConfig = {
Label = "org.wireguard.wg0";
RunAtLoad = true;
KeepAlive = false;
StandardOutPath = "/var/log/wireguard.log";
StandardErrorPath = "/var/log/wireguard.log";
};
};
}
hosts/cyper-controller/configuration.nix
+11
View File
@@ -22,6 +22,17 @@
useNetworkd = true;
useDHCP = false;
firewall.enable = true;
wireguard.interfaces.wg0 = {
ips = [ "10.10.0.2/24" ];
peers = [
{
publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
endpoint = "178.254.8.35:51820";
allowedIPs = [ "10.10.0.0/24" ];
persistentKeepalive = 25;
}
];
};
};
systemd.network = {
hosts/cyper-desktop/configuration.nix
+11
View File
@@ -6,6 +6,17 @@
useNetworkd = true;
useDHCP = false;
firewall.enable = true;
wireguard.interfaces.wg0 = {
ips = [ "10.10.0.40/24" ];
peers = [
{
publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
endpoint = "178.254.8.35:51820";
allowedIPs = [ "10.10.0.0/24" ];
persistentKeepalive = 25;
}
];
};
};
systemd.network = {
hosts/cyper-mac/configuration.nix
+3 -1
View File
@@ -1 +1,3 @@
{ ... }: { }
{
launchd.daemons.wireguard.environment.WG_IP = "10.10.0.3/24";
}
hosts/cyper-node-1/configuration.nix
+11
View File
@@ -8,6 +8,17 @@
useNetworkd = true;
useDHCP = false;
firewall.enable = true;
wireguard.interfaces.wg0 = {
ips = [ "10.10.0.30/24" ];
peers = [
{
publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
endpoint = "178.254.8.35:51820";
allowedIPs = [ "10.10.0.0/24" ];
persistentKeepalive = 25;
}
];
};
};
systemd.network = {
hosts/cyper-node-2/configuration.nix
+11
View File
@@ -8,6 +8,17 @@
useNetworkd = true;
useDHCP = false;
firewall.enable = true;
wireguard.interfaces.wg0 = {
ips = [ "10.10.0.31/24" ];
peers = [
{
publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
endpoint = "178.254.8.35:51820";
allowedIPs = [ "10.10.0.0/24" ];
persistentKeepalive = 25;
}
];
};
};
systemd.network = {
hosts/cyper-proxy/configuration.nix
+28
View File
@@ -37,9 +37,37 @@
"178.254.16.141"
];
wireguard.interfaces.wg0 = {
ips = [ "10.10.0.1/24" ];
listenPort = 51820;
peers = [
{
publicKey = "EvML4de3CReNW8aF+lJAsPZ+p6FICOyjCsAZJBwIwX8=";
allowedIPs = [ "10.10.0.2/32" ];
}
{
publicKey = "WkY45tGnNZQuJTf1MPN6I92spxHts/kpzXRSZE9se2c=";
allowedIPs = [ "10.10.0.3/32" ];
}
{
publicKey = "oAstNd7Wxpj2PqSyS87q+8y8WtaLK7hZ5Ytfncml9EM=";
allowedIPs = [ "10.10.0.40/32" ];
}
{
publicKey = "GrFH3I5QqjRij7Jl+eOL6Ou6zK6MtH5/kAsA5AmGckM=";
allowedIPs = [ "10.10.0.30/32" ];
}
{
publicKey = "IddGAijZVCVxGj/aMasjfroIy9r8Owar4MO9xfvNNBY=";
allowedIPs = [ "10.10.0.31/32" ];
}
];
};
firewall.allowedTCPPorts = [
80
443
51820
];
hosts = {
hosts/cyper-proxy/hardware-configuration.nix
+4 -4
View File
@@ -16,6 +16,7 @@
];
kernelModules = [ ];
};
kernel.sysctl."net.ipv4.ip_forward" = 1;
kernelModules = [ ];
extraModulePackages = [ ];
};
@@ -30,10 +31,9 @@
"mode=755"
];
};
"/nix".neededForBoot = true;
"/persist".neededForBoot = true;
};
fileSystems."/nix".neededForBoot = true;
fileSystems."/persist".neededForBoot = true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}
nixos/default.nix
+1 -1
View File
@@ -11,7 +11,7 @@
imports = [
./sops.nix
./locale.nix
./tailscale.nix
./wireguard.nix
./ssh.nix
./impermanence.nix
]
nixos/tailscale.nix
-10
View File
@@ -1,10 +0,0 @@
{ config, ... }:
{
sops.secrets.tailscale_auth_key = { };
services.tailscale = {
enable = true;
openFirewall = true;
authKeyFile = config.sops.secrets.tailscale_auth_key.path;
};
}
nixos/wireguard.nix
+14
View File
@@ -0,0 +1,14 @@
{ config, hostName, ... }:
{
sops.secrets."wireguard/${hostName}" = {
mode = "0400";
};
networking = {
wireguard.interfaces.wg0 = {
privateKeyFile = config.sops.secrets."wireguard/${hostName}".path;
};
firewall.allowedUDPPorts = [ 51820 ];
};
}
secrets/secrets.yaml
+9 -2
View File
@@ -35,6 +35,13 @@ ssh_private_key: ENC[AES256_GCM,data:R511mVFVk1ogAd5CKk/2P6rtT4NnHIFfKyqeCen545Q
ssh_github_key: ENC[AES256_GCM,data:vZAH4cRDsgGXLAppQKOyUPOvmBJZ27bujMGz4hQ8tt0xhGFUP28llwGZz/VRuU02Yv4alLgVWBAIPuyhZT9f35KnjIR1Mmb7HXk/6oaNM59/lBiISLrnOpC10WmJ9O5krKdxwP8ZDvHA34B0s+oYNkTNXiU0S8AVg3icploax7ylKH5Dorj53kjdYSTjd8KN6ZsgCKmcz97+GnP0IgdmauyNL7e+kv9WIfE8Xx1kGvC8WVnidX2YhSxm6vt8l60eUj9etRigU88oFYTDZ+mIf4lucSpzaLZutz2fM/16D/o9SS7mmTrEllj2S+IXc9ZZTRKKDLbW+yv0XUi0XZi+OHAdZScjS54NZKyT9uWrc/IDJHammGsoHRQpHZtbGhkeFi/KdJsYBsWItslXjM0xJVtFIM2tMnd10kv9UGuXsSl9J4NC0rpz3aXnQqG4ZAhMjN9D/DTJpB4K0pcFyd2FDWdrbKq5iPfnU/V6ecnHPML6wCt6gua/LdK1MWoG3l2SqwMLYj1r7UW5fQZqSw1EK0BAtp9cQMLBL/2w8ykMfWpLekE=,iv:gcinU7xOoXQkFVkLNB3sQYHAcZy3pZN+bDRIq4sspys=,tag:yawgAHBKIkGpnKPHsRId4g==,type:str]
nix_cache_priv_key: ENC[AES256_GCM,data:FbRHM4n7BDMDgZYtTOdpS0SQx80afxMC3uw6PtdKb1zcAjyQRYwJe0esTDLklLDh8Kx6dgZOJbrf2sYIzF5xVv09U1Uz0C1UnF4M6yhbg+Nqg0HfVj55L3Z6ulrxNlgq7gY=,iv:F9DZUsyzZocKoB0yByeBcrCw9Ytcp+Xk6y8+ZH4OV7k=,tag:mSf1zVciPkifzr3kVFAt0g==,type:str]
tailscale_auth_key: ENC[AES256_GCM,data:jJU2WKuiYTLcYyoCXeBMpc/mmjOH6JupIofo5CQbs0bGcnBrv3wNtmI2TR2dqdyohx9d7DJUkjrIgi2OWRI=,iv:zWPqc7cErVZaI6vRbSbPrcEKZmKCoEsDKhnjKTlgsJA=,tag:TLwUzfyyKnmOuWdpTG7Uow==,type:str]
wireguard:
cyper-proxy: ENC[AES256_GCM,data:ohe1JLavTPpEcQl+EGPcmJodBn6KaLf7S7aCLrHEgROklcX28Yjm1m4uW0Q=,iv:4iEO3ay0sqaRUxsqR3P7XFpbD6mnnq73yNsZbT22iGU=,tag:HwQaId/xi6OF99z9bZf6ew==,type:str]
cyper-desktop: ENC[AES256_GCM,data:pABywoxw/BURnpwCfsvXD7jmN+fa6NyHmJIKpR6pkTUNHE2h1xsD64M54JE=,iv:UcDWk1ULbbxBDad/MDD94Iaj2bB/xlpLWtsuPTP6E7c=,tag:La/PWVzumCusn9IaAFkxwQ==,type:str]
cyper-controller: ENC[AES256_GCM,data:q85Tw7GGuoMlsRPDlPJ0n3aUw3cOejmjDwxSBr6Jkw+L7ZAU9yz7vthIpho=,iv:CdHhEqAOBMqsa3ZWD2RIoTlyObBpnUQhdZncmq8u7W0=,tag:tCYXugIb7rQDkgwRsY023Q==,type:str]
cyper-node-1: ENC[AES256_GCM,data:+Des2tr8Fja0IarMmn6xc2bjYIlwfoVmdXMRC8yyenIrke+SS09/VV8ed/A=,iv:xL6gxjur1FNDtziNP/bEGyUXZ9VD9wmxHmWb6BR3xig=,tag:RGLuXGMAJSaREE9b9RnnfA==,type:str]
cyper-node-2: ENC[AES256_GCM,data:0vjNM8xgHXQtKDeKD6NBYjn3jpt9NMsLgaxZOzb9wgg1HTeLjwhK7Xw12Co=,iv:CETgdC0nKP5n8XMZj++bXWUY/harcJu+wj3S3ksLE0U=,tag:6EHF7DWi0ruKjJht1ndWcA==,type:str]
cyper-mac: ENC[AES256_GCM,data:8MSy7ALUwYyk42CpIuiym4L3VIn0MSyxr0M1Gz+t/hAwzNdvWQkYUZirZ+Q=,iv:eUbXRhhR3/ZQGJE/Uf0bISWx1YeOuPqhhMBo4CwF23w=,tag:mgfXWrEWyS3AsvlA6EJq8g==,type:str]
sops:
age:
- enc: |
@@ -46,7 +53,7 @@ sops:
6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w==
-----END AGE ENCRYPTED FILE-----
recipient: age10pyhca0jy75wtqv5hrn0gf0jcam5272zx9h73a8xwwaxyfq89c0qs5dr9t
lastmodified: "2026-06-28T21:28:16Z"
mac: ENC[AES256_GCM,data:PTeAIxRx+TWjvLrIrh5KHsxRtIIMJxXQIb1b3Q50Kx11toNnijmrjIRjPgrT//D+9KMyTqJCXK8mZ3VFW/658fawsxbfLQuOyVP2XI2vl77Cc+aZDDTsCrHZkcMn1VHZuoPRqZP4yZm9H8RkAqtdLg1WB7WTcJso3MiDWf9tBRk=,iv:qPRtIyUFE1xuficyrfmSua9CvuU1IYZmCtcaXOQeXkg=,tag:ZrEbRsVjyVHMLYuuYAcGzw==,type:str]
lastmodified: "2026-06-29T09:16:03Z"
mac: ENC[AES256_GCM,data:IN9vRP9kYa/KRo2R6A/g2azBLOj/twoX4NY88iT9JG092QVeeSmvgDoQ+heb0b8rBcfFbEtVFZkGZkjr9eUBfp2gaFw1j958PahH/Mm03R++SSoYr29yHlPkBuWUkQzhUv4vQ8nQQvueY8U9FmFEUoP6uV+MBhYkhUyAsONWGZk=,iv:H6zeAUndn98wTGs1elTVPkLJDYbm/n5l5wdD9HBU8qU=,tag:PAYt8w3X/6o+z3h3NHINRA==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.1