fi/nix-infra
1
1
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Use another subnet for WireGuard tunnel as is conflicts with the openstack internal subnet

Browse source
This commit is contained in:
yuri 2023-09-19 00:07:23 +02:00
parent f9971c842e
commit cd938d5020
5 changed files with 16 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
config/hosts/lifeline/configuration.nix
View file

@ -20,23 +20,23 @@
interfaces.wg0 = { interfaces.wg0 = {
listenPort = 51820; listenPort = 51820;
ips = [ ips = [
"172.16.50.1/24" "172.18.50.1/24"
]; ];
peers = [ peers = [
{ {
name = "mail-2"; name = "mail-2";
publicKey = "OIBOJlFzzM3P/u1ftVW2HWt8kA6NveB4PaBOIXhCYhM="; publicKey = "OIBOJlFzzM3P/u1ftVW2HWt8kA6NveB4PaBOIXhCYhM=";
presharedKeyFile = "/secrets/wireguard-lifeline-mail-2-lifeline-psk.secret"; presharedKeyFile = "/secrets/wireguard-lifeline-mail-2-lifeline-psk.secret";
allowedIPs = [ "172.16.50.2/32" ]; allowedIPs = [ "172.18.50.2/32" ];
} }
]; ];
postSetup = '' postSetup = ''
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 172.16.50.0/24 -o ens6 -j MASQUERADE ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 172.18.50.0/24 -o ens6 -j MASQUERADE
''; '';
postShutdown = '' postShutdown = ''
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT ${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 172.16.50.0/24 -o ens6 -j MASQUERADE ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 172.18.50.0/24 -o ens6 -j MASQUERADE
''; '';
privateKeyFile = "/secrets/wireguard-lifeline-wg0-privatekey.secret"; privateKeyFile = "/secrets/wireguard-lifeline-wg0-privatekey.secret";
}; };
@ -46,7 +46,7 @@
internalInterfaces = [ "wg0" ]; internalInterfaces = [ "wg0" ];
externalInterface = "ens6"; externalInterface = "ens6";
forwardPorts = [{ forwardPorts = [{
destination = "172.16.50.2:25"; destination = "172.18.50.2:25";
proto = "tcp"; proto = "tcp";
sourcePort = 25; sourcePort = 25;
}]; }];

4
config/hosts/mail-1/configuration.nix
View file

@ -44,11 +44,11 @@
"wg0" = { "wg0" = {
matchConfig.Name = "wg0"; matchConfig.Name = "wg0";
address = [ address = [
"172.16.50.2/24" "172.18.50.2/24"
]; ];
DHCP = "no"; DHCP = "no";
gateway = [ gateway = [
"172.16.50.1" "172.18.50.1"
]; ];
}; };
}; };

3
config/hosts/mail-1/simple-nixos-mailserver.nix
View file

@ -59,11 +59,8 @@
services.postfix = { services.postfix = {
transport = "relay:[mail-2.grzb.de]"; transport = "relay:[mail-2.grzb.de]";
<<<<<<< HEAD
extraConfig = '' extraConfig = ''
proxy_interfaces = 212.53.203.19 proxy_interfaces = 212.53.203.19
''; '';
=======
>>>>>>> 0e55e66 (Use systemd-networkd on mail servers)
}; };
} }

4
config/hosts/mail-2/configuration.nix
View file

@ -44,11 +44,11 @@
"wg0" = { "wg0" = {
matchConfig.Name = "wg0"; matchConfig.Name = "wg0";
address = [ address = [
"172.16.50.2/24" "172.18.50.2/24"
]; ];
DHCP = "no"; DHCP = "no";
gateway = [ gateway = [
"172.16.50.1" "172.18.50.1"
]; ];
}; };
}; };

14
config/hosts/valkyrie/configuration.nix
View file

@ -48,23 +48,23 @@
wg1 = { wg1 = {
listenPort = 51822; listenPort = 51822;
ips = [ ips = [
"172.16.50.1/24" "172.18.50.1/24"
]; ];
peers = [ peers = [
{ {
name = "mail-1"; name = "mail-1";
publicKey = "CyKPjkY1ah/lE6V3R0XugNo28doeAtD8wEtAeDB7bHs="; publicKey = "CyKPjkY1ah/lE6V3R0XugNo28doeAtD8wEtAeDB7bHs=";
presharedKeyFile = "/secrets/wireguard-valkyrie-mail-1-valkyrie-psk.secret"; presharedKeyFile = "/secrets/wireguard-valkyrie-mail-1-valkyrie-psk.secret";
allowedIPs = [ "172.16.50.2/32" ]; allowedIPs = [ "172.18.50.2/32" ];
} }
]; ];
postSetup = '' postSetup = ''
${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -j ACCEPT ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 172.16.50.0/24 -o ens3 -j MASQUERADE ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 172.18.50.0/24 -o ens3 -j MASQUERADE
''; '';
postShutdown = '' postShutdown = ''
${pkgs.iptables}/bin/iptables -D FORWARD -i wg1 -j ACCEPT ${pkgs.iptables}/bin/iptables -D FORWARD -i wg1 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 172.16.50.0/24 -o ens3 -j MASQUERADE ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 172.18.50.0/24 -o ens3 -j MASQUERADE
''; '';
privateKeyFile = "/secrets/wireguard-valkyrie-wg1-privatekey.secret"; privateKeyFile = "/secrets/wireguard-valkyrie-wg1-privatekey.secret";
}; };
@ -76,17 +76,17 @@
externalInterface = "ens3"; externalInterface = "ens3";
forwardPorts = [ forwardPorts = [
{ {
destination = "172.16.50.2:25"; destination = "172.18.50.2:25";
proto = "tcp"; proto = "tcp";
sourcePort = 25; sourcePort = 25;
} }
{ {
destination = "172.16.50.2:465"; destination = "172.18.50.2:465";
proto = "tcp"; proto = "tcp";
sourcePort = 465; sourcePort = 465;
} }
{ {
destination = "172.16.50.2:993"; destination = "172.18.50.2:993";
proto = "tcp"; proto = "tcp";
sourcePort = 993; sourcePort = 993;
} }