saklas: wireguard and stuff

1 files changed, 53 insertions, 5 deletions

diff --git a/hosts/saklas/default.nix b/hosts/saklas/default.nix
index 170e1be..faeb1b6 100644
--- a/hosts/saklas/default.nix
+++ b/hosts/saklas/default.nix
@@ -9,12 +9,60 @@
   networking = {
     hostName = "saklas";
     hostId = "b0bababe";
+    useDHCP = false;
 
     wireless.enable = false;
 
     firewall = {
       allowedTCPPorts = [ 22 80 443 ];
-      allowedUDPPorts = [ 51413 ];
+      allowedUDPPorts = [ 3478 51820 ];
+    };
+
+    # VPN
+    wireguard.interfaces = {
+      # vpn to vps
+      wg0 = {
+        ips = [ "10.0.13.1/24" ];
+        listenPort = 51820;
+        privateKey = "***REMOVED***";
+
+        peers = [
+          {
+            # demiurge
+            allowedIPs = [ "10.0.13.2/32" ];
+            publicKey = "kdvqM1fph4eglG33vCELCVIMKNu4ln/rm6MwcymeNUw=";
+            presharedKey = "***REMOVED***";
+          }
+          {
+            # lappy
+            allowedIPs = [ "10.0.13.3/32" ];
+            publicKey = "fqxxnp7mJAr52oBDjSd+J1iu3/RUUg++XCXtUfnLWhs=";
+            presharedKey = "***REMOVED***";
+          }
+          {
+            # iphonebob
+            allowedIPs = [ "10.0.13.4/32" ];
+            publicKey = "lZ4C67LdkE/zcMKyt5l8fKffieOz2yC7WN3v0w0OCTI=";
+            presharedKey = "***REMOVED***";
+          }
+        ];
+      };
+    };
+  };
+
+  systemd.network = {
+    enable = true;
+    networks."10-wan" = {
+      matchConfig.Name = "enp1s0";
+      networkConfig.DHCP = "no";
+      address = [
+        "95.217.18.52/32"
+        "2a01:4f9:c010:a653::1/64"
+      ];
+      routes = [
+        { Destination = "172.31.1.1"; }
+        { Gateway = "172.31.1.1"; GatewayOnLink = true; }
+      ];
     };
   };
 
@@ -137,21 +185,21 @@
           };
         };
 
-        "vinbiz.ca" = {
+        "13f0.net" = {
           enableACME = true;
           forceSSL = true;
           locations."/" = {
             index = "index.html";
-            root = "/var/www/vinbiz_html";
+            root = "/var/www/13f0_html";
           };
         };
 
-        "13f0.net" = {
+        "vinbiz.ca" = {
           enableACME = true;
           forceSSL = true;
           locations."/" = {
             index = "index.html";
-            root = "/var/www/13f0_html";
+            root = "/var/www/vinbiz_html";
           };
         };
       };