colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

vpn-servo: allow coexistence with wg-home

Browse Source
This commit is contained in:
Colin
2023-09-19 16:03:20 +00:00
parent e3e2af46a1
commit 57e35eeab1
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
hosts/common/vpn.nix
View File

@@ -1,4 +1,4 @@
{ config, lib, ... }: { config, lib, pkgs, ... }:
# to add a new OVPN VPN: # to add a new OVPN VPN:
# - generate a privkey `wg genkey` # - generate a privkey `wg genkey`
@@ -8,7 +8,7 @@
# - copy the Address, PublicKey, Endpoint from OVPN's config # - copy the Address, PublicKey, Endpoint from OVPN's config
# N.B.: maximum interface name in Linux is 15 characters. # N.B.: maximum interface name in Linux is 15 characters.
let let
def-wg-vpn = name: { endpoint, publicKey, address, dns, privateKeyFile }: { def-wg-vpn = name: { endpoint, publicKey, address, dns, privateKeyFile, extraOptions ? {} }: {
networking.wg-quick.interfaces."${name}" = { networking.wg-quick.interfaces."${name}" = {
inherit address privateKeyFile dns; inherit address privateKeyFile dns;
peers = [ peers = [
@@ -22,7 +22,7 @@ let
]; ];
# to start: `systemctl start wg-quick-${name}` # to start: `systemctl start wg-quick-${name}`
autostart = false; autostart = false;
}; } // extraOptions;
}; };
def-ovpn = name: { endpoint, publicKey, address }: def-wg-vpn "ovpnd-${name}" { def-ovpn = name: { endpoint, publicKey, address }: def-wg-vpn "ovpnd-${name}" {
inherit endpoint publicKey address; inherit endpoint publicKey address;
@@ -33,12 +33,21 @@ let
]; ];
}; };
# TODO: this should live in the same file as hosts/modules/wg-home.nix...
# TODO: update sane-vpn script to also allow activating/deactiving this interface
def-servo = def-wg-vpn "vpn-servo" { def-servo = def-wg-vpn "vpn-servo" {
endpoint = config.sane.hosts.by-name."servo".wg-home.endpoint; endpoint = config.sane.hosts.by-name."servo".wg-home.endpoint;
publicKey = config.sane.hosts.by-name."servo".wg-home.pubkey; publicKey = config.sane.hosts.by-name."servo".wg-home.pubkey;
address = [ config.sane.services.wg-home.ip ]; address = [ config.sane.services.wg-home.ip ];
dns = [ "10.78.79.1" ]; dns = [ "10.78.79.1" ];
privateKeyFile = config.networking.wireguard.interfaces.wg-home.privateKeyFile; privateKeyFile = config.networking.wireguard.interfaces.wg-home.privateKeyFile;
extraOptions = {
# wg-home and vpn-servo interfaces interfere with the result that when connected to both,
# other wg-home users (lappy-hn, ...) aren't visible. disabling wg-home while the full
# vpn-servo is active allows wg-home users to be reachable again
preUp = "${pkgs.iproute2}/bin/ip link set wg-home down";
postDown = "${pkgs.iproute2}/bin/ip link set wg-home up";
};
}; };
in lib.mkMerge [ in lib.mkMerge [
(def-servo) (def-servo)