diff options
| author | Tim Keller <tjk@tjkeller.xyz> | 2026-06-18 21:40:18 -0500 |
|---|---|---|
| committer | Tim Keller <tjk@tjkeller.xyz> | 2026-06-18 21:40:18 -0500 |
| commit | 0e2dff02520f25057444cdac87755a9ea8e50518 (patch) | |
| tree | 4139d57756a8ddc581b0665f1edbebd32b7847e2 /hosts/poweredge/networking.nix | |
| parent | 1996d32bef8a2d4454e680fb2d559d436e35b275 (diff) | |
| parent | 8368775f94428a6c34f76146c3f07be88f1244a2 (diff) | |
| download | nixos-0e2dff02520f25057444cdac87755a9ea8e50518.tar.xz nixos-0e2dff02520f25057444cdac87755a9ea8e50518.zip | |
Merge branch 'master' of publicgit:nixos
Diffstat (limited to 'hosts/poweredge/networking.nix')
| -rw-r--r-- | hosts/poweredge/networking.nix | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/hosts/poweredge/networking.nix b/hosts/poweredge/networking.nix index 8b84645..bf0aa1c 100644 --- a/hosts/poweredge/networking.nix +++ b/hosts/poweredge/networking.nix @@ -25,8 +25,9 @@ in { config, ... }: { }]; }; - # Wireguard office tunnel secret - sops.secrets.wg0-router.sopsFile = ./resources/secrets/wg0-router.yaml; + # Secrets + sops.secrets.router-wg0 = { sopsFile = ./resources/secrets/router.yaml; key = "wg0"; }; # Office + sops.secrets.router-wg1 = { sopsFile = ./resources/secrets/router.yaml; key = "wg1"; }; # Remote access # Router container containers.router = { @@ -47,9 +48,13 @@ in { config, ... }: { hostAddress = "10.255.255.2"; localAddress = "10.255.255.1"; }; - # Bind wg0-router secret to container + # Bind secrets to container bindMounts."/run/secrets/wg0" = { - hostPath = config.sops.secrets.wg0-router.path; + hostPath = config.sops.secrets.router-wg0.path; + isReadOnly = true; + }; + bindMounts."/run/secrets/wg1" = { + hostPath = config.sops.secrets.router-wg1.path; isReadOnly = true; }; @@ -72,6 +77,7 @@ in { config, ... }: { # Setup wireguard wg-quick.interfaces = { wg0.configFile = "/run/secrets/wg0"; + wg1.configFile = "/run/secrets/wg1"; }; # NAT (port-forwarding) rules nat.forwardPorts =[ @@ -86,6 +92,7 @@ in { config, ... }: { destination = "192.168.1.45:9000"; } ]; + firewall.allowedUDPPorts = [ 51820 ]; # Allow wg1 running on router host through w/o NAT # Additional advanced rules # TODO add multi NAT feature to router service (this is just a normal nat rule) nftables = { |