132 lines
2.3 KiB
Nix
132 lines
2.3 KiB
Nix
{
|
|
config,
|
|
hostname,
|
|
pkgs,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
./wireguard.nix
|
|
./tailscale.nix
|
|
];
|
|
sops.secrets = {
|
|
"wg0/conf".sopsFile = ./secrets/vpn.yaml;
|
|
"wg-br0/conf".sopsFile = ./secrets/vpn.yaml;
|
|
"wg-us0/conf".sopsFile = ./secrets/vpn.yaml;
|
|
"wg-uk0/conf".sopsFile = ./secrets/vpn.yaml;
|
|
};
|
|
|
|
services.tailscale-netns = {
|
|
enable = true;
|
|
instances.work = {
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
hostName = hostname;
|
|
networkmanager.enable = false;
|
|
nameservers = [ "192.168.88.3" ];
|
|
useDHCP = false;
|
|
useNetworkd = true;
|
|
|
|
# vlans.vlan66 = {
|
|
# id = 66;
|
|
# interface = "br0";
|
|
# };
|
|
# interfaces = {
|
|
# br0.useDHCP = true;
|
|
# vlan66.useDHCP = true;
|
|
# };
|
|
# bridges.br0 = {
|
|
# interfaces = [ inetInterface ];
|
|
# };
|
|
firewall.allowedTCPPorts = [
|
|
5900
|
|
8080
|
|
9003
|
|
10000
|
|
10001
|
|
11000
|
|
11001
|
|
12000
|
|
12001
|
|
13000
|
|
13001
|
|
];
|
|
};
|
|
|
|
systemd.network = {
|
|
enable = true;
|
|
netdevs."20-br0" = {
|
|
netdevConfig = {
|
|
Kind = "bridge";
|
|
Name = "br0";
|
|
};
|
|
};
|
|
|
|
networks."10-tap" = {
|
|
matchConfig.Name = [
|
|
"en*"
|
|
"eth*"
|
|
];
|
|
networkConfig.Bridge = "br0";
|
|
};
|
|
|
|
networks."20-br0" = {
|
|
matchConfig.Name = "br0";
|
|
networkConfig = {
|
|
DHCP = "yes";
|
|
};
|
|
linkConfig.RequiredForOnline = "routable";
|
|
};
|
|
|
|
networks."30-vm-1" = {
|
|
matchConfig.Name = "vm-1";
|
|
address = [ "10.0.0.1/24" ];
|
|
networkConfig.IPMasquerade = "both";
|
|
};
|
|
|
|
};
|
|
|
|
networking.nat = {
|
|
enable = true;
|
|
internalInterfaces = [ "vm-*" ];
|
|
externalInterface = "br0";
|
|
};
|
|
|
|
services.resolved = {
|
|
enable = true;
|
|
settings = {
|
|
Resolve = {
|
|
Domains = [ "~." ];
|
|
FallbackDNS = null;
|
|
};
|
|
};
|
|
};
|
|
|
|
services.wireguard-netns = {
|
|
enable = true;
|
|
namespaces = {
|
|
wg0 = {
|
|
dns = "10.2.0.1";
|
|
address = "10.2.0.2/32";
|
|
conf = "wg0/conf";
|
|
};
|
|
wg-br0 = {
|
|
dns = "10.2.0.1";
|
|
address = "10.2.0.2/32";
|
|
conf = "wg-br0/conf";
|
|
};
|
|
wg-us0 = {
|
|
dns = "10.2.0.1";
|
|
address = "10.2.0.2/32";
|
|
conf = "wg-us0/conf";
|
|
};
|
|
wg-uk0 = {
|
|
dns = "10.2.0.1";
|
|
address = "10.2.0.2/32";
|
|
conf = "wg-uk0/conf";
|
|
};
|
|
};
|
|
};
|
|
}
|