diff options
| author | makefu <github@syntax-fehler.de> | 2023-07-02 17:09:35 +0200 |
|---|---|---|
| committer | makefu <github@syntax-fehler.de> | 2023-07-02 17:09:35 +0200 |
| commit | a41e86290ff75a8c621a9b3dd05f6fc119c0b2ef (patch) | |
| tree | 8b2765741c1358bad179479665a197138d24d899 /2configs/wireguard | |
| parent | f2b95c76172b2e1dae75c89202183d22d79c2cf4 (diff) | |
treewide: replace <secrets> with sops.secrets
Diffstat (limited to '2configs/wireguard')
| -rw-r--r-- | 2configs/wireguard/server.nix | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/2configs/wireguard/server.nix b/2configs/wireguard/server.nix index bb3198178..426403df2 100644 --- a/2configs/wireguard/server.nix +++ b/2configs/wireguard/server.nix @@ -7,6 +7,9 @@ in { # wireguard server # boot.kernel.sysctl."net.ipv4.ip_forward" = 1; # conf.all.proxy_arp =1 + + sops.secrets."wireguard.key" = {}; + networking.firewall = { allowedUDPPorts = [ 51820 ]; }; @@ -20,7 +23,7 @@ in { # wireguard server networking.wireguard.interfaces.wg0 = { ips = [ "10.244.0.1/24" ]; listenPort = 51820; - privateKeyFile = (toString <secrets>) + "/wireguard.key"; + privateKeyFile = config.sops.secrets."wireguard.key".path; # allowedIPsAsRoutes = true; postSetup = '' ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.244.0.0/24 -o ${ext-if} -j MASQUERADE |