2023-09-19 16:03:20 +00:00
|
|
|
{ config, lib, pkgs, ... }:
|
2022-06-10 00:41:03 +00:00
|
|
|
|
2022-12-13 03:45:49 +00:00
|
|
|
# to add a new OVPN VPN:
|
|
|
|
# - generate a privkey `wg genkey`
|
|
|
|
# - add this key to `sops secrets/universal.yaml`
|
|
|
|
# - upload pubkey to OVPN.com
|
|
|
|
# - generate config @ OVPN.com
|
|
|
|
# - copy the Address, PublicKey, Endpoint from OVPN's config
|
2022-12-13 04:13:01 +00:00
|
|
|
# N.B.: maximum interface name in Linux is 15 characters.
|
2022-12-13 03:17:27 +00:00
|
|
|
let
|
2023-09-19 16:03:20 +00:00
|
|
|
def-wg-vpn = name: { endpoint, publicKey, address, dns, privateKeyFile, extraOptions ? {} }: {
|
2023-09-19 15:29:47 +00:00
|
|
|
networking.wg-quick.interfaces."${name}" = {
|
|
|
|
inherit address privateKeyFile dns;
|
2022-12-13 03:45:49 +00:00
|
|
|
peers = [
|
|
|
|
{
|
|
|
|
allowedIPs = [
|
|
|
|
"0.0.0.0/0"
|
|
|
|
"::/0"
|
|
|
|
];
|
|
|
|
inherit endpoint publicKey;
|
|
|
|
}
|
|
|
|
];
|
2023-09-19 15:29:47 +00:00
|
|
|
# to start: `systemctl start wg-quick-${name}`
|
2022-12-13 03:45:49 +00:00
|
|
|
autostart = false;
|
2023-09-19 16:03:20 +00:00
|
|
|
} // extraOptions;
|
2022-06-10 00:41:03 +00:00
|
|
|
};
|
2023-09-19 15:29:47 +00:00
|
|
|
def-ovpn = name: { endpoint, publicKey, address }: def-wg-vpn "ovpnd-${name}" {
|
|
|
|
inherit endpoint publicKey address;
|
|
|
|
privateKeyFile = config.sops.secrets."wg/ovpnd_${name}_privkey".path;
|
|
|
|
dns = [
|
|
|
|
"46.227.67.134"
|
|
|
|
"192.165.9.158"
|
|
|
|
];
|
|
|
|
};
|
2022-12-13 03:45:49 +00:00
|
|
|
in lib.mkMerge [
|
|
|
|
(def-ovpn "us" {
|
2022-12-13 03:17:27 +00:00
|
|
|
endpoint = "vpn31.prd.losangeles.ovpn.com:9929";
|
|
|
|
publicKey = "VW6bEWMOlOneta1bf6YFE25N/oMGh1E1UFBCfyggd0k=";
|
|
|
|
address = [
|
|
|
|
"172.27.237.218/32"
|
|
|
|
"fd00:0000:1337:cafe:1111:1111:ab00:4c8f/128"
|
|
|
|
];
|
2022-12-13 03:45:49 +00:00
|
|
|
})
|
2022-12-13 04:26:00 +00:00
|
|
|
# NB: us-* share the same wg key and link-local addrs, but distinct public addresses
|
2022-12-13 04:13:01 +00:00
|
|
|
(def-ovpn "us-atl" {
|
2022-12-13 03:26:23 +00:00
|
|
|
endpoint = "vpn18.prd.atlanta.ovpn.com:9929";
|
|
|
|
publicKey = "Dpg/4v5s9u0YbrXukfrMpkA+XQqKIFpf8ZFgyw0IkE0=";
|
|
|
|
address = [
|
|
|
|
"172.21.182.178/32"
|
|
|
|
"fd00:0000:1337:cafe:1111:1111:cfcb:27e3/128"
|
|
|
|
];
|
2022-12-13 03:45:49 +00:00
|
|
|
})
|
2022-12-13 04:26:00 +00:00
|
|
|
(def-ovpn "us-mi" {
|
|
|
|
endpoint = "vpn34.prd.miami.ovpn.com:9929";
|
|
|
|
publicKey = "VtJz2irbu8mdkIQvzlsYhU+k9d55or9mx4A2a14t0V0=";
|
|
|
|
address = [
|
|
|
|
"172.21.182.178/32"
|
|
|
|
"fd00:0000:1337:cafe:1111:1111:cfcb:27e3/128"
|
|
|
|
];
|
|
|
|
})
|
2022-12-13 03:45:49 +00:00
|
|
|
(def-ovpn "ukr" {
|
2022-12-13 03:17:27 +00:00
|
|
|
endpoint = "vpn96.prd.kyiv.ovpn.com:9929";
|
|
|
|
publicKey = "CjZcXDxaaKpW8b5As1EcNbI6+42A6BjWahwXDCwfVFg=";
|
2022-07-09 07:48:09 +00:00
|
|
|
address = [
|
|
|
|
"172.18.180.159/32"
|
|
|
|
"fd00:0000:1337:cafe:1111:1111:ec5c:add3/128"
|
|
|
|
];
|
2022-12-13 03:45:49 +00:00
|
|
|
})
|
|
|
|
]
|