wireguard-server: use namespaced secrets

This commit is contained in:
makefu 2023-10-02 01:22:26 +02:00
parent 8525509d15
commit 8d6a820594
No known key found for this signature in database
GPG key ID: 36F7711F3FC0F225

View file

@ -8,8 +8,7 @@ in { # wireguard server
# boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
# conf.all.proxy_arp =1
sops.secrets."wireguard.key" = {};
networking.firewall = {
allowedUDPPorts = [ 51820 ];
};
@ -23,7 +22,7 @@ in { # wireguard server
networking.wireguard.interfaces.wg0 = {
ips = [ "10.244.0.1/24" ];
listenPort = 51820;
privateKeyFile = config.sops.secrets."wireguard.key".path;
privateKeyFile = config.sops.secrets."${config.clanCore.machineName}-wireguard.key".path;
# allowedIPsAsRoutes = true;
postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.244.0.0/24 -o ${ext-if} -j MASQUERADE