116 lines
3.2 KiB
Nix
116 lines
3.2 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
|
|
let
|
|
fachschaftCommon = {
|
|
ipv4 = {
|
|
address1 = "10.252.10.4/32";
|
|
method = "manual";
|
|
dns = "1.1.1.1;";
|
|
dns-search = "~;";
|
|
};
|
|
ipv6 = {
|
|
addr-gen-mode = "default";
|
|
method = "disabled";
|
|
};
|
|
proxy = { };
|
|
wireguard = {
|
|
mtu = "1450";
|
|
private-key = "$VPN_FS_PRIV_KEY";
|
|
};
|
|
"wireguard-peer.If3/NKCnOfdJZmZFCR/2GXVR1+sdEBJ1JaBEdeYE9Uo=" = {
|
|
endpoint = "141.40.176.36:51820";
|
|
persistent-keepalive = "15";
|
|
preshared-key = "$VPN_FS_PSK";
|
|
preshared-key-flags = "0";
|
|
};
|
|
};
|
|
|
|
zuhauseCommon = {
|
|
ipv4 = {
|
|
address1 = "192.168.178.11/24";
|
|
method = "manual";
|
|
dns = "192.168.178.5;192.168.178.1;";
|
|
dns-search = "~;fritz.box;";
|
|
};
|
|
ipv6 = {
|
|
address1 = "fd00:cf9d:7912:2003::11/64";
|
|
method = "manual";
|
|
dns = "fd00:cf9d:7912:2003::5;fd00:cf9d:7912:2003:de39:6fff:fede:bc06;";
|
|
dns-search = "~;fritz.box;";
|
|
};
|
|
proxy = { };
|
|
wireguard = {
|
|
private-key = "$VPN_ZUHAUSE_PRIV_KEY";
|
|
};
|
|
"wireguard-peer.cmKnQXhQk9ObLW5lBwN5Zs5VUzcpiI3iTJcfGQYfT10=" = {
|
|
endpoint = "photos.huber.cloud:52321";
|
|
persistent-keepalive = "25";
|
|
preshared-key = "$VPN_ZUHAUSE_PSK";
|
|
preshared-key-flags = "0";
|
|
};
|
|
};
|
|
in
|
|
{
|
|
environment.systemPackages = with pkgs; [
|
|
wireguard-tools
|
|
];
|
|
|
|
sops.secrets."networkmanager/env" = {
|
|
sopsFile = ../../secrets/vpn.yaml;
|
|
};
|
|
networking.networkmanager.ensureProfiles.environmentFiles = [
|
|
config.sops.secrets."networkmanager/env".path
|
|
];
|
|
|
|
networking.networkmanager.ensureProfiles.profiles = {
|
|
Fachschaft-Split = lib.recursiveUpdate fachschaftCommon {
|
|
connection = {
|
|
id = "fachschaft-split";
|
|
autoconnect = false;
|
|
interface-name = "fachschaft";
|
|
type = "wireguard";
|
|
uuid = "08d46cd7-9796-40dc-9daa-6ed248e9cac6";
|
|
};
|
|
ipv4.never-default = true;
|
|
"wireguard-peer.If3/NKCnOfdJZmZFCR/2GXVR1+sdEBJ1JaBEdeYE9Uo=".allowed-ips = "10.19.5.0/24;";
|
|
};
|
|
Fachschaft-Full = lib.recursiveUpdate fachschaftCommon {
|
|
connection = {
|
|
id = "fachschaft-full";
|
|
autoconnect = false;
|
|
interface-name = "fachschaft-full";
|
|
type = "wireguard";
|
|
uuid = "7a3a4885-9c6d-41e1-87ba-8daa25c5cb7d";
|
|
};
|
|
"wireguard-peer.If3/NKCnOfdJZmZFCR/2GXVR1+sdEBJ1JaBEdeYE9Uo=".allowed-ips = "0.0.0.0/0;";
|
|
};
|
|
Zuhause-Split = lib.recursiveUpdate zuhauseCommon {
|
|
connection = {
|
|
id = "zuhause-split";
|
|
autoconnect = false;
|
|
interface-name = "zuhause-split";
|
|
type = "wireguard";
|
|
uuid = "81618ae4-5b94-4483-95b1-29bd6464c5b9";
|
|
};
|
|
ipv4.never-default = true;
|
|
ipv6.never-default = true;
|
|
"wireguard-peer.cmKnQXhQk9ObLW5lBwN5Zs5VUzcpiI3iTJcfGQYfT10=".allowed-ips =
|
|
"192.168.178.0/24;fd00:cf9d:7912:2003::/64;";
|
|
};
|
|
Zuhause-Full = lib.recursiveUpdate zuhauseCommon {
|
|
connection = {
|
|
id = "zuhause-full";
|
|
autoconnect = false;
|
|
interface-name = "zuhause-full";
|
|
type = "wireguard";
|
|
uuid = "80bc1d7d-6b89-4ad0-a028-804f12bd69b4";
|
|
};
|
|
"wireguard-peer.cmKnQXhQk9ObLW5lBwN5Zs5VUzcpiI3iTJcfGQYfT10=".allowed-ips = "0.0.0.0/0;::/0;";
|
|
};
|
|
};
|
|
}
|