fi/nix-infra
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix WireGuard nat rules

Browse source
This commit is contained in:
fi 2023-09-18 03:38:09 +02:00
parent f67a75b07d
commit e7fe3707ee
Signed by: fi
SSH key fingerprint: SHA256:d+6fQoDPMbSFK95zRVflRKZLRKF4cPSQb7VIxYkhFsA
11 changed files with 269 additions and 61 deletions
Download patch file Download diff file Expand all files Collapse all files

91
config/hosts/mail-2/configuration.nix Normal file
View file

@ -0,0 +1,91 @@
{ pkgs, ... }:
{
boot.loader.grub = {
enable = true;
device = "/dev/vda";
};
systemd.network = {
enable = true;
networks = {
"enp6s18" = {
matchConfig.Name = "enp6s18";
address = [
"10.201.41.100/24"
];
routes = [
{
routeConfig = {
Gateway = "10.201.41.1";
Destination = "10.201.0.0/16";
};
}
{
routeConfig = {
Gateway = "10.201.41.1";
Destination = "10.202.0.0/16";
};
}
{
routeConfig = {
Gateway = "10.201.41.1";
Destination = "172.21.87.0/24";
};
}
{
routeConfig = {
Gateway = "10.201.41.1";
Destination = "217.160.117.160/32";
};
}
];
linkConfig.RequiredForOnline = "routable";
};
"wg0" = {
matchConfig.Name = "wg0";
address = [
"172.16.50.2/24"
];
DHCP = "no";
gateway = [
"172.16.50.1"
];
};
};
netdevs = {
"wg0" = {
netdevConfig = {
Kind = "wireguard";
Name = "wg0";
};
wireguardConfig = {
PrivateKeyFile = "/secrets/wireguard-mail-2-wg0-privatekey.secret";
};
wireguardPeers = [{
wireguardPeerConfig = {
PublicKey = "Nnf7x+Yd+l8ZkK2BTq1lK3iiTYgdrgL9PQ/je8smug4=";
PresharedKeyFile = "/secrets/wireguard-lifeline-mail-2-mail-2-psk.secret";
Endpoint = "217.160.117.160:51820";
AllowedIPs = [ "0.0.0.0/0" ];
PersistentKeepalive = 25;
};
}];
};
};
};
networking = {
hostName = "mail-2";
useDHCP = false;
firewall = {
enable = true;
allowedTCPPorts = [ 25 ];
};
};
environment.systemPackages = with pkgs; [
wireguard-tools
];
system.stateVersion = "23.05";
}

7
config/hosts/mail-2/default.nix Normal file
View file

@ -0,0 +1,7 @@
{ ... }:
{
imports = [
./configuration.nix
./postfix.nix
];
}

17
config/hosts/mail-2/postfix.nix Normal file
View file

@ -0,0 +1,17 @@
{ ... }: {
# Postfix relay configuration, see: https://www.postfix.org/STANDARD_CONFIGURATION_README.html#backup
services.postfix = {
enable = true;
hostname = "mail-2.grzb.de";
relayDomains = [
"grzb.de"
"nekover.se"
];
extraConfig = ''
message_size_limit = 20971520
smtpd_relay_restrictions = permit_mynetworks reject_unauth_destination
proxy_interfaces = 217.160.117.160
relay_recipient_maps =
'';
};
}

19
config/hosts/mail-2/secrets.nix Normal file
View file

@ -0,0 +1,19 @@
{ ... }:
{
deployment.keys."wireguard-mail-2-wg0-privatekey.secret" = {
keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/mail-2-wg0-privatekey" ];
destDir = "/secrets";
user = "root";
group = "systemd-network";
permissions = "0640";
uploadAt = "pre-activation";
};
deployment.keys."wireguard-lifeline-mail-2-mail-2-psk.secret" = {
keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/lifeline-mail-2/psk" ];
destDir = "/secrets";
user = "root";
group = "systemd-network";
permissions = "0640";
uploadAt = "pre-activation";
};
}