Fiona Grzebien
c288ff153a
Flake lock file updates:
• Updated input 'nixpkgs':
'github:NixOS/nixpkgs/7f04f29e010fdf57851461605322d7c2b95f9f15?narHash=sha256-hwD5/IbAs5FTdg7R2VPWlVsAwrVDmILa%2Bw8gj4U3HQQ%3D' (2026-05-20)
→ 'github:NixOS/nixpkgs/63ec6699e426863863e065730574a1f336e4925a?narHash=sha256-4H8sc3E4lGoLmM5M5EmDoVpfAzMuz75q2/UNQV2h/Yg%3D' (2026-05-23)
• Updated input 'nixpkgs-master':
'github:NixOS/nixpkgs/22dcc7e4821c231607aacd682b035f29fabc2f8f?narHash=sha256-AMcWQ3mQUrdeXiJaCHXYh%2Bc5tBI3lTsbymEUXPRegdo%3D' (2026-05-20)
→ 'github:NixOS/nixpkgs/89afca31a77b6850e7335d60e3d35cd742e772cb?narHash=sha256-aJYBdQXSD2gMlD39zP35E5qcPN91f3GWI5%2B9RHxiHsc%3D' (2026-05-24)
• Updated input 'nixpkgs-unstable':
'github:NixOS/nixpkgs/8e72e9888e67ce593df16546cd31e0d75544ad0d?narHash=sha256-O3UFKrh5oDyOwqD4Njdf7%2BSIxptOl3gHZyesYvNsIbw%3D' (2026-05-20)
→ 'github:NixOS/nixpkgs/19942a940b16e7e7285e3cf58f09fa1aeb2f90cd?narHash=sha256-6SjdsouT54k1%2B/DyBqTJwdFlja4RBNq9jP9N%2B8kBIa0%3D' (2026-05-23)
94 lines
2.1 KiB
Nix
94 lines
2.1 KiB
Nix
{ pkgs, ... }:
|
|
{
|
|
boot.loader.grub = {
|
|
enable = true;
|
|
device = "/dev/vda";
|
|
};
|
|
|
|
systemd.network = {
|
|
enable = true;
|
|
networks = {
|
|
"enp6s18" = {
|
|
matchConfig.Name = "enp6s18";
|
|
address = [
|
|
"10.202.41.123/24"
|
|
];
|
|
routes = [
|
|
{
|
|
Gateway = "10.202.41.1";
|
|
Destination = "10.201.0.0/16";
|
|
}
|
|
{
|
|
Gateway = "10.202.41.1";
|
|
Destination = "10.202.0.0/16";
|
|
}
|
|
{
|
|
Gateway = "10.202.41.1";
|
|
Destination = "172.21.87.0/24";
|
|
}
|
|
{
|
|
Gateway = "10.202.41.1";
|
|
Destination = "212.53.203.19/32";
|
|
}
|
|
];
|
|
linkConfig.RequiredForOnline = "routable";
|
|
};
|
|
"wg0" = {
|
|
matchConfig.Name = "wg0";
|
|
address = [
|
|
"172.18.50.2/24"
|
|
];
|
|
DHCP = "no";
|
|
gateway = [
|
|
"172.18.50.1"
|
|
];
|
|
};
|
|
};
|
|
netdevs = {
|
|
"wg0" = {
|
|
netdevConfig = {
|
|
Kind = "wireguard";
|
|
Name = "wg0";
|
|
};
|
|
wireguardConfig = {
|
|
PrivateKeyFile = "/run/secrets/wireguard-mail-1-wg0-privatekey";
|
|
};
|
|
wireguardPeers = [{
|
|
PublicKey = "ik480irMZtGBs1AFpf1KGzDBekjdziD3ck7XK8r1WXQ=";
|
|
PresharedKeyFile = "/run/secrets/wireguard-valkyrie-mail-1-mail-1-psk";
|
|
Endpoint = "212.53.203.19:51822";
|
|
AllowedIPs = [ "0.0.0.0/0" ];
|
|
PersistentKeepalive = 25;
|
|
}];
|
|
};
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
hostName = "mail-1";
|
|
useDHCP = false;
|
|
firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [ 25 465 993 ];
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
wireguard-tools
|
|
];
|
|
|
|
sops.secrets."wireguard-valkyrie-mail-1-mail-1-psk" = {
|
|
mode = "0440";
|
|
owner = "systemd-network";
|
|
group = "systemd-network";
|
|
restartUnits = [ "systemd-networkd.service" ];
|
|
};
|
|
sops.secrets."wireguard-mail-1-wg0-privatekey" = {
|
|
mode = "0440";
|
|
owner = "systemd-network";
|
|
group = "systemd-network";
|
|
restartUnits = [ "systemd-networkd.service" ];
|
|
};
|
|
|
|
system.stateVersion = "23.05";
|
|
}
|