wg-home: re-enable keepalives
this should fix some of the flakiness i've seen when deploying moby?
This commit is contained in:
@@ -97,6 +97,7 @@ in
|
|||||||
sane.vpn.wg-home = lib.mkIf cfg.routeThroughServo {
|
sane.vpn.wg-home = lib.mkIf cfg.routeThroughServo {
|
||||||
id = 51;
|
id = 51;
|
||||||
endpoint = config.sane.hosts.by-name."servo".wg-home.endpoint;
|
endpoint = config.sane.hosts.by-name."servo".wg-home.endpoint;
|
||||||
|
keepalive = true;
|
||||||
publicKey = config.sane.hosts.by-name."servo".wg-home.pubkey;
|
publicKey = config.sane.hosts.by-name."servo".wg-home.pubkey;
|
||||||
addrV4 = cfg.ip;
|
addrV4 = cfg.ip;
|
||||||
subnetV4 = "24";
|
subnetV4 = "24";
|
||||||
|
@@ -70,6 +70,14 @@ let
|
|||||||
e.g. "vpn.example.com:55280"
|
e.g. "vpn.example.com:55280"
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
keepalive = mkOption {
|
||||||
|
type = types.bool;
|
||||||
|
default = false;
|
||||||
|
description = ''
|
||||||
|
whether to send periodic packets to keep the NAT alive.
|
||||||
|
this should only be needed if you want to receive unprompted inbound packets.
|
||||||
|
'';
|
||||||
|
};
|
||||||
publicKey = mkOption {
|
publicKey = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
description = ''
|
description = ''
|
||||||
@@ -118,7 +126,7 @@ let
|
|||||||
priorityFwMark = config.id + 300;
|
priorityFwMark = config.id + 300;
|
||||||
};
|
};
|
||||||
});
|
});
|
||||||
mkVpnConfig = name: { addrV4, dns, endpoint, fwmark, id, privateKeyFile, publicKey, subnetV4, ... }: {
|
mkVpnConfig = name: { addrV4, dns, endpoint, fwmark, id, keepalive, privateKeyFile, publicKey, subnetV4, ... }: {
|
||||||
assertions = [
|
assertions = [
|
||||||
{
|
{
|
||||||
assertion = (lib.count (c: c.id == id) (builtins.attrValues cfg)) == 1;
|
assertion = (lib.count (c: c.id == id) (builtins.attrValues cfg)) == 1;
|
||||||
@@ -136,14 +144,18 @@ let
|
|||||||
PrivateKeyFile = privateKeyFile;
|
PrivateKeyFile = privateKeyFile;
|
||||||
FirewallMark = fwmark;
|
FirewallMark = fwmark;
|
||||||
};
|
};
|
||||||
wireguardPeers = [{
|
wireguardPeers = [
|
||||||
|
({
|
||||||
AllowedIPs = [
|
AllowedIPs = [
|
||||||
"0.0.0.0/0"
|
"0.0.0.0/0"
|
||||||
"::/0"
|
"::/0"
|
||||||
];
|
];
|
||||||
Endpoint = endpoint;
|
Endpoint = endpoint;
|
||||||
PublicKey = publicKey;
|
PublicKey = publicKey;
|
||||||
}];
|
} // lib.optionalAttrs keepalive {
|
||||||
|
PersistentKeepalive = 25;
|
||||||
|
})
|
||||||
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.network.networks."50-${name}" = {
|
systemd.network.networks."50-${name}" = {
|
||||||
|
Reference in New Issue
Block a user