48 lines
1.6 KiB
Nix
48 lines
1.6 KiB
Nix
# Sol-style client pool for personal mesh.
|
|
# Backbone peers use wg-mesh; phones/laptops use this separate interface.
|
|
{ config, pkgs, ... }:
|
|
{
|
|
environment.systemPackages = [ pkgs.wireguard-tools ];
|
|
|
|
networking.wireguard.interfaces.wg-clients1 = {
|
|
ips = [ "10.0.1.1/24" ];
|
|
listenPort = 51821;
|
|
privateKeyFile = "/var/lib/wireguard/wg-clients1.key";
|
|
allowedIPsAsRoutes = false;
|
|
peers = [
|
|
{
|
|
# lilac (Pixel 9 Pro), generated on poppy; private key is not in git.
|
|
publicKey = "RAvcRTdFBcvAGZWRm6YBMjRHRGj0iMNxsE0MBPGUPjM=";
|
|
allowedIPs = [ "10.0.1.10/32" ];
|
|
}
|
|
];
|
|
};
|
|
|
|
networking.firewall.allowedUDPPorts = [ 51821 ];
|
|
|
|
# allowedIPsAsRoutes=false keeps peer declarations as crypto ACLs; install
|
|
# the client identity route explicitly, as in the backbone design.
|
|
networking.interfaces.wg-clients1.ipv4.routes = [
|
|
{ address = "10.0.1.10"; prefixLength = 32; }
|
|
];
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /var/lib/wireguard 0700 root root -"
|
|
];
|
|
|
|
# Generate the server key on first activation, outside the Nix store.
|
|
systemd.services.wireguard-key-wg-clients1 = {
|
|
description = "Generate wg-clients1 private key if absent";
|
|
wantedBy = [ "wireguard-wg-clients1.service" ];
|
|
before = [ "wireguard-wg-clients1.service" ];
|
|
serviceConfig.Type = "oneshot";
|
|
script = ''
|
|
install -d -m 700 /var/lib/wireguard
|
|
if [ ! -s /var/lib/wireguard/wg-clients1.key ]; then
|
|
umask 077
|
|
${pkgs.wireguard-tools}/bin/wg genkey > /var/lib/wireguard/wg-clients1.key
|
|
chmod 600 /var/lib/wireguard/wg-clients1.key
|
|
fi
|
|
'';
|
|
};
|
|
}
|