diff options
Diffstat (limited to 'os/srv/wireguard.nix')
| -rw-r--r-- | os/srv/wireguard.nix | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/os/srv/wireguard.nix b/os/srv/wireguard.nix index 15675a4..363ac9f 100644 --- a/os/srv/wireguard.nix +++ b/os/srv/wireguard.nix @@ -27,6 +27,11 @@ in default = "eth0"; description = "The public WAN interface of the server"; }; + publicKey = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = null; + description = "The public key of your primary WireGuard server node."; + }; peers = lib.mkOption { type = lib.types.listOf ( @@ -93,17 +98,16 @@ in iifname "wg0" accept oifname "wg0" accept } - chain postrouting { type nat hook postrouting priority 100; policy accept; - iifname "wg0" oifname "${cfg.server.externalInterface}" masquerade + oifname "${cfg.server.externalInterface}" masquerade } ''; }; }; networking.wireguard.interfaces.wg0 = { - ips = [ "10.255.1.1/16" ]; + ips = [ "10.255.1.1/24" ]; listenPort = 51280; privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path; @@ -129,13 +133,12 @@ in ]; networking.wireguard.interfaces.wg0 = { - ips = [ "10.255.0.${toString cfg.client.index}/16" ]; + ips = [ "10.255.0.${toString cfg.client.index}/24" ]; privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path; peers = [ { - # TODO get the server public key - publicKey = ""; + publicKey = cfg.server.publicKey; endpoint = "${masterDomain}:51280"; persistentKeepalive = 25; |