commit f24e47c26c0e3c0993b446b1afebfa83a086a290 parent 9b6070a6a86f5bffad32a675f728a1de453731e3 Author: Vineet Kumar <git@vineetk.net> Date: Thu, 25 Dec 2025 21:52:26 -0500 add wireguard config for demiurge Diffstat:
| M | epistemia/systems/demiurge.scm | | | 91 | +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-- |
1 file changed, 89 insertions(+), 2 deletions(-)
diff --git a/epistemia/systems/demiurge.scm b/epistemia/systems/demiurge.scm @@ -1,12 +1,15 @@ (define-module (epistemia systems demiurge) #:use-module (gnu) #:use-module (gnu packages emacs) + #:use-module (gnu packages golang-crypto) + #:use-module (gnu packages linux) #:use-module (gnu packages version-control) #:use-module (gnu services desktop) #:use-module (gnu services linux) #:use-module (gnu services networking) #:use-module (gnu services shepherd) #:use-module (gnu services ssh) + #:use-module (gnu services vpn) #:use-module (gnu system accounts) #:use-module (guix) #:use-module (guix gexp) @@ -101,6 +104,90 @@ (extra-content "\ ListenAddress 127.0.0.1:22 ListenAddress 192.168.1.2:22 - ListenAddress 10.0.13.2:22")))) - %base-services))) + ListenAddress 10.0.13.2:22"))) + (service wireguard-service-type + (wireguard-configuration + (interface "wg0") + (addresses '("10.68.117.111/32" "fc00:bbbb:bbbb:bb01::5:756e/128")) + (port 51821) + (bootstrap-private-key? #f) + (private-key + #~(string-append "<(" + #$(file-append age "/bin/age -d -i /data/ssh/id_ed25519") + " /data/src/public/guixsd-config/epistemia/secrets/wg0_demiurge.age)")) + (pre-up '("ip route replace 45.134.142.206 via 192.168.1.1 dev eth0")) + (post-down '("ip route del 45.134.142.206 via 192.168.1.1 dev eth0")) + (peers + (list + (wireguard-peer + (name "mullvad-us-mia-wg-002") + (public-key "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=") + (allowed-ips '("0.0.0.0/0" "::0/0")) + (endpoint "45.134.142.206:51820")))))) + (service wireguard-service-type + (wireguard-configuration + (interface "wg1") + (addresses '("10.0.13.2/24" "fd00:b0ba:cafe:babe::2/64 ")) + (port 51820) + (bootstrap-private-key? #f) + (private-key + #~(string-append "<(" + #$(file-append age "/bin/age -d -i /data/ssh/id_ed25519") + " /data/src/public/guixsd-config/epistemia/secrets/wg1_demiurge.age)")) + (table #f) + (post-up + ;; IPv4 and IPv6 NAT + (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -I POSTROUTING 1 -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE") + #~(string-append #$(file-append iptables "/sbin/iptables") " -N WG1-FWD") + + ;; IPv4 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/iptables") " -I FORWARD 1 -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/iptables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT") + + ;; IPv6 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -N WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -I FORWARD 1 -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT"))) + (pre-down + ;; IPv4 and IPv6 NAT + (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE") + ;; IPv4 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/iptables") " -D FORWARD -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/iptables") " -F WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/iptables") " -X WG1-FWD") + + ;; IPv6 Forwarding Chain + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -D FORWARD -j WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -F WG1-FWD") + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -X WG1-FWD"))) + (peers + (list + (wireguard-peer + (name "saklas.epistemia") + (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=") + (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128")) + (endpoint "157.180.125.215:51820") + (keep-alive 25)) + (wireguard-peer + (name "hastur.epistemia") + (public-key "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=") + (allowed-ips '("10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128")) + (keep-alive 25)) + (wireguard-peer + (name "iphonebob.epistemia") + (public-key "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=") + (allowed-ips '("10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128")) + (keep-alive 25)) + (wireguard-peer + (name "lab.epistemia") + (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=") + (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128")) + (keep-alive 25))))))) + %base-services)))