lasuite-federez/nix
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

switch to a full networkd setup

Browse source
This commit is contained in:
asyncnomi 2025-07-22 23:07:45 +02:00
parent 09c91ccf84
commit 1d704ccbc8
3 changed files with 65 additions and 77 deletions
Download patch file Download diff file Expand all files Collapse all files

46
shared/bastion/wireguard.nix
View file

@ -12,36 +12,44 @@ let
buildSecret = zone: {
"wg-private-zone-${toString zone}" = {
file = ./../../secrets/bastion + ( "/wg-private-zone-" + toString zone + ".age" );
owner = "root";
group = "root";
owner = "systemd-network";
group = "systemd-network";
};
};
peers = map (peerConfig: {
name = "${peerConfig.name}";
publicKey = peerConfig.publicKey;
allowedIPs = [
interfacePeers = map (peerConfig: {
PublicKey = peerConfig.publicKey;
AllowedIPs = [
"172.19.${toString (myZone + 127)}.${toString peerConfig.id}/32"
"fc00:f::${toString (myZone + 127)}:${toString peerConfig.id}/128"
];
persistentKeepalive = 25;
PersistentKeepalive = 25;
}) users-wg;
interface = {
"mgmt" = {
ips = [
"172.19.${toString (myZone + 127)}.254/24"
"fc00:f::${toString (myZone + 127)}:254/96"
];
privateKeyFile = config.age.secrets."wg-private-zone-${toString myZone}".path;
listenPort = 51920;
peers = peers;
};
interfaceConfig = {
PrivateKeyFile = config.age.secrets."wg-private-zone-${toString myZone}".path;
ListenPort = 51920;
};
in
{
age.secrets = buildSecret myZone;
# Return all WireGuard interfaces for each node
networking.wireguard.interfaces = interface;
# Build Management interface
systemd.network = {
netdevs."mgmt" = {
netdevConfig = {
Name = "mgmt";
Kind = "wireguard";
};
wireguardConfig = interfaceConfig;
wireguardPeers = interfacePeers;
};
networks."mgmt" = {
matchConfig.Name = "mgmt";
address = [
"172.19.${toString (myZone + 127)}.254/24"
"fc00:f::${toString (myZone + 127)}:254/96"
];
};
};
}