coolneng
/
zion
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Migrate to systemd-networkd

This commit is contained in:
coolneng 2022-12-20 15:04:11 +01:00
parent 663e5cb739
commit 39e2d8f4e5
Signed by: coolneng
GPG Key ID: 9893DA236405AF57
2 changed files with 53 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
configuration.nix
View File

@ -105,7 +105,11 @@ with pkgs;
# Specify secrets # Specify secrets
age = { age = {
secrets.wireguard.file = secrets/wireguard.age; secrets.wireguard = {
file = secrets/wireguard.age;
owner = "systemd-network";
group = "systemd-network";
};
secrets.syncthing.file = secrets/syncthing.age; secrets.syncthing.file = secrets/syncthing.age;
secrets.msmtp.file = secrets/msmtp.age; secrets.msmtp.file = secrets/msmtp.age;
secrets.gitea = { secrets.gitea = {

70
modules/networking.nix
View File

@ -3,23 +3,24 @@
let wireguard_port = 1194; let wireguard_port = 1194;
in { in {
# Assign a static IP # Enable systemd-networkd
networking = { networking = {
hostName = "zion"; hostName = "zion";
hostId = "4e74ea68"; hostId = "4e74ea68";
interfaces.eth0 = {
useDHCP = false; useDHCP = false;
ipv4.addresses = [{ useNetworkd = true;
address = "192.168.13.2"; dhcpcd.enable = false;
prefixLength = 24;
}];
}; };
defaultGateway = { systemd.services."systemd-networkd-wait-online".enable = false;
address = "192.168.13.1";
interface = "eth0"; # Assign a static IP
}; systemd.network.networks."24-home" = {
nameservers = [ "51.158.108.203" "137.220.55.93" ]; name = "eth0";
enableIPv6 = false; matchConfig.Name = "eth0";
address = [ "192.168.13.2/24" ];
gateway = [ "192.168.13.1" ];
dns = [ "51.158.108.203" "137.220.55.93" ];
networkConfig.DNSSEC = "no";
}; };
# Enable zeroconf # Enable zeroconf
@ -61,38 +62,47 @@ in {
''; '';
}; };
# Enable NAT for wireguard
networking.nat = {
enable = true;
externalInterface = "eth0";
internalInterfaces = [ "wg0" ];
};
# Wireguard setup # Wireguard setup
networking.wireguard.interfaces = { systemd.network.netdevs."wg0" = {
wg0 = { netdevConfig = {
ips = [ "10.8.0.1/24" ]; Kind = "wireguard";
listenPort = wireguard_port; Name = "wg0";
privateKeyFile = config.age.secrets.wireguard.path; };
peers = [ wireguardConfig = {
ListenPort = wireguard_port;
PrivateKeyFile = config.age.secrets.wireguard.path;
};
wireguardPeers = [
# panacea # panacea
{ {
publicKey = "XMkTztU2Y8hw6Fu/2o4Gszij+EmNacvFMXuZyHS1n38="; wireguardPeerConfig = {
allowedIPs = [ "10.8.0.2/32" ]; PublicKey = "XMkTztU2Y8hw6Fu/2o4Gszij+EmNacvFMXuZyHS1n38=";
AllowedIPs = [ "10.8.0.2/32" ];
};
} }
# caravanserai # caravanserai
{ {
publicKey = "eeKfAgMisM3K4ZOErev05RJ9LS2NLqL4x9jyi4XhM1Q="; wireguardPeerConfig = {
allowedIPs = [ "10.8.0.3/32" ]; PublicKey = "eeKfAgMisM3K4ZOErev05RJ9LS2NLqL4x9jyi4XhM1Q=";
AllowedIPs = [ "10.8.0.3/32" ];
};
} }
]; ];
}; };
systemd.network.networks."wg0" = {
matchConfig.Name = "wg0";
networkConfig = {
Address = "10.8.0.1/24";
IPForward = true;
IPMasquerade = "ipv4";
};
}; };
# DNS server with ad-block # DNS server with ad-block
services.dnsmasq = { services.dnsmasq = {
enable = true; enable = true;
servers = config.networking.nameservers; servers = config.systemd.network.networks."24-home".dns;
extraConfig = '' extraConfig = ''
domain-needed domain-needed
bogus-priv bogus-priv