From 12f53416b8591fd9ee9569b40796f355c83f3ce7 Mon Sep 17 00:00:00 2001 From: Dylan Date: Tue, 16 Sep 2025 22:10:50 +1200 Subject: feat: added wireguard to server and client --- computers/nixnode.nix | 171 ++++++++++++++++++++++++++++++++++++++++++++++++++ computers/nixy.nix | 75 +++++++++++++++++----- computers/server.nix | 169 ------------------------------------------------- 3 files changed, 229 insertions(+), 186 deletions(-) create mode 100644 computers/nixnode.nix delete mode 100644 computers/server.nix (limited to 'computers') diff --git a/computers/nixnode.nix b/computers/nixnode.nix new file mode 100644 index 0000000..baeadcb --- /dev/null +++ b/computers/nixnode.nix @@ -0,0 +1,171 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page, on +# https://search.nixos.org/options and in the NixOS manual (`nixos-help`). + +{ config, lib, pkgs, inputs, ... }: + +{ + imports = + [ # Include the results of the hardware scan. + ../modules/nix.nix + inputs.STK.nixosModules.default + inputs.sops.nixosModules.sops + ]; + + # Use the GRUB 2 boot loader. + boot.loader.grub.enable = true; + # boot.loader.grub.efiSupport = true; + # boot.loader.grub.efiInstallAsRemovable = true; + # boot.loader.efi.efiSysMountPoint = "/boot/efi"; + # Define on which hard drive you want to install Grub. + # boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only + + networking.hostName = "nixos"; # Define your hostname. + # Pick only one of the below networking options. + # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. + networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. + + # Set your time zone. + # time.timeZone = "Europe/Amsterdam"; + + # Configure network proxy if necessary + # networking.proxy.default = "http://user:password@proxy:port/"; + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; + + # Select internationalisation properties. + # i18n.defaultLocale = "en_US.UTF-8"; + # console = { + # font = "Lat2-Terminus16"; + # keyMap = "us"; + # useXkbConfig = true; # use xkb.options in tty. + # }; + + # Enable the X11 windowing system. + # services.xserver.enable = true; + + security.sudo.wheelNeedsPassword = false; + + sops.defaultSopsFile = ../secrets/general.yaml; + sops.defaultSopsFormat = "yaml"; + + sops.age.keyFile = "/home/boss/.config/sops/age/keys.txt"; + + sops.secrets = { + #"wg/nixy/pub" = { }; + "wg/nixnode/priv" = { }; + }; + + networking.firewall = { + enable = true; + allowedTCPPorts = [ 80 443 ]; + allowedUDPPorts = [ 51820 ]; + }; + + # Wireguard + networking = { + nat = { + enable = true; + externalInterface = "eth0"; + internalInterfaces = [ "wg0" ]; + }; + + wireguard.interfaces.wg0 = { + ips = [ "10.100.0.1/24" ]; + listenPort = 51820; + + postSetup = '' +${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE +''; + postShutdown = '' +${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE +''; + + privateKeyFile = config.sops.secrets."wg/nixnode/priv".path; + + peers = [ + { + name = "nixy"; + publicKey = "FMkFU9k+YeCvj48+WDVglySgoncbITqkS//o2e+TClY="; + allowedIPs = [ "10.100.0.2/32" ]; + } + ]; + }; + }; + + services.httpd = { + enable = true; + virtualHosts."172.105.172.191" = { + documentRoot = "/srv/httpd"; + }; + }; + + services.openssh = { + enable = true; + settings.PermitRootLogin = "no"; + settings.PasswordAuthentication = false; + }; + + services.superTuxKarts = { + enable = true; + port = 2757; + serverOptions = { + server-name = "LUG STK server"; + server-mode = 0; + server-difficulty = 3; + private-server-password = "lug@uoa"; + motd = "Server for LUG@UoA\nChampionship coming soon!"; + }; + }; + + users.users.boss = { + isNormalUser = true; + extraGroups = [ "wheel" "networkmanager" ]; # Enable ‘sudo’ for the user. + home = "/home/boss"; + openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOukEKExoF6vr3vciQN8pBdd4FtZtRzqIGFJrUvllOY boss@nixy" ]; + }; + + environment.systemPackages = with pkgs; [ + vim + emacs + inetutils + mtr + sysstat + git + ]; + + + # Open ports in the firewall. + # networking.firewall.allowedTCPPorts = [ ... ]; + # networking.firewall.allowedUDPPorts = [ ... ]; + # Or disable the firewall altogether. + # networking.firewall.enable = false; + + networking.usePredictableInterfaceNames = false; + networking.useDHCP = false; + networking.interfaces.eth0.useDHCP = true; + + # Copy the NixOS configuration file and link it from the resulting system + # (/run/current-system/configuration.nix). This is useful in case you + # accidentally delete configuration.nix. + # system.copySystemConfiguration = true; + + # This option defines the first version of NixOS you have installed on this particular machine, + # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. + # + # Most users should NEVER change this value after the initial install, for any reason, + # even if you've upgraded your system to a new NixOS release. + # + # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, + # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how + # to actually do that. + # + # This value being lower than the current NixOS release does NOT mean your system is + # out of date, out of support, or vulnerable. + # + # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, + # and migrated your data accordingly. + # + # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . + system.stateVersion = "25.05"; # Did you read the comment? + +} diff --git a/computers/nixy.nix b/computers/nixy.nix index e7b7fbe..fd79b47 100644 --- a/computers/nixy.nix +++ b/computers/nixy.nix @@ -5,11 +5,11 @@ { config, pkgs, inputs, ... }: { imports = - [ # Include the results of the hardware scan. - ../hardware-setups/tuf.nix + [ ../modules/nix.nix ../modules/nvidia.nix inputs.YATwm.nixosModules.default + inputs.sops.nixosModules.sops #inputs.spicetify-nix.nixosModules.default ]; @@ -31,29 +31,69 @@ # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. + sops.defaultSopsFile = ../secrets/general.yaml; + sops.defaultSopsFormat = "yaml"; + + sops.age.keyFile = "/home/boss/.config/sops/age/keys.txt"; + + sops.secrets = { + #"wg/nixnode/pub" = { }; + "wg/nixy/priv" = { + restartUnits = [ "nm-file-secret-agent.service" ]; + group = "networkmanager"; + mode = "440"; + }; + }; + networking.firewall = { allowedUDPPorts = [ 51820 ]; }; - networking.wireguard.enable = false; - networking.wireguard.interfaces.wg0 = { - ips = [ "10.200.200.2/32" ]; - listenPort = 51820; - - privateKeyFile = "/home/boss/.wg/peer_A.key"; - - peers = [ + networking.networkmanager.ensureProfiles = { + profiles = { + wg-nixnode = { + connection = { + id = "wg-nixnode"; + autoconnect = "false"; + interface-name = "wg0"; + type = "wireguard"; + }; + ipv4 = { + address1 = "10.100.0.2/32"; + may-fail = "false"; + method = "manual"; + }; + ipv6 = { + method = "disabled"; + }; + wireguard = { + listen-port = "51820"; + private-key-flags = 1; + #private-key = "dummy"; + }; + proxy = { }; + "wireguard-peer./6bWy02DhOSjaeXk+ol5ATgEYDDJvL+mTO9SCNvfIUQ=" = { + allowed-ips = "0.0.0.0/0;"; + endpoint = "172.105.172.191:51820"; + persistent-keepalive = "25"; + }; + }; + }; + secrets.entries = [ { - publicKey = "wQSg97FyVqWqkwMbmq1SLolf/MWlt9tIJuE5vKyDiRI="; - - allowedIPs = [ "0.0.0.0/0" ]; - - endpoint = "139.144.99.248:51820"; - - persistentKeepalive = 25; + matchId = "wg-nixnode"; + matchType = "wireguard"; + matchSetting = "wireguard"; + key = "private-key"; + file = config.sops.secrets."wg/nixy/priv".path; } ]; }; + systemd.services."nm-file-secret-agent" = { + serviceConfig.User = "boss"; + }; + + # Set your time zone. time.timeZone = "NZ"; @@ -167,6 +207,7 @@ neofetch pinentry-gtk2 git + nm-file-secret-agent ]; documentation.dev.enable = true; diff --git a/computers/server.nix b/computers/server.nix deleted file mode 100644 index 4e66375..0000000 --- a/computers/server.nix +++ /dev/null @@ -1,169 +0,0 @@ -# Edit this configuration file to define what should be installed on -# your system. Help is available in the configuration.nix(5) man page, on -# https://search.nixos.org/options and in the NixOS manual (`nixos-help`). - -{ config, lib, pkgs, inputs, ... }: - -{ - imports = - [ # Include the results of the hardware scan. - ../hardware-setups/linode.nix - ../modules/nix.nix - inputs.STK.nixosModules.default - inputs.sops.nixosModules.sops - ]; - - # Use the GRUB 2 boot loader. - boot.loader.grub.enable = true; - # boot.loader.grub.efiSupport = true; - # boot.loader.grub.efiInstallAsRemovable = true; - # boot.loader.efi.efiSysMountPoint = "/boot/efi"; - # Define on which hard drive you want to install Grub. - # boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only - - # networking.hostName = "nixos"; # Define your hostname. - # Pick only one of the below networking options. - # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. - # networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. - - # Set your time zone. - # time.timeZone = "Europe/Amsterdam"; - - # Configure network proxy if necessary - # networking.proxy.default = "http://user:password@proxy:port/"; - # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; - - # Select internationalisation properties. - # i18n.defaultLocale = "en_US.UTF-8"; - # console = { - # font = "Lat2-Terminus16"; - # keyMap = "us"; - # useXkbConfig = true; # use xkb.options in tty. - # }; - - # Enable the X11 windowing system. - # services.xserver.enable = true; - - security.sudo.wheelNeedsPassword = false; - - sops.defaultSopsFile = ../secrets/test.yaml; - sops.defaultSopsFormat = "yaml"; - - sops.age.keyFile = "/home/boss/.config/sops/age/keys.txt"; - - sops.secrets = { - test-value = {}; - }; - - services.httpd = { - enable = false; - virtualHosts."172.105.172.191" = { - documentRoot = "/srv/httpd"; - }; - }; - - - # Configure keymap in X11 - # services.xserver.xkb.layout = "us"; - # services.xserver.xkb.options = "eurosign:e,caps:escape"; - - # Enable CUPS to print documents. - # services.printing.enable = true; - - # Enable sound. - # services.pulseaudio.enable = true; - # OR - # services.pipewire = { - # enable = true; - # pulse.enable = true; - # }; - - # Enable touchpad support (enabled default in most desktopManager). - # services.libinput.enable = true; - - # Define a user account. Don't forget to set a password with ‘passwd’. - users.users.boss = { - isNormalUser = true; - extraGroups = [ "wheel" "networkmanager" ]; # Enable ‘sudo’ for the user. - home = "/home/boss"; - openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOukEKExoF6vr3vciQN8pBdd4FtZtRzqIGFJrUvllOY boss@nixy" ]; - }; - - # programs.firefox.enable = true; - - # List packages installed in system profile. - # You can use https://search.nixos.org/ to find more packages (and options). - environment.systemPackages = with pkgs; [ - vim - emacs - inetutils - mtr - sysstat - git - ]; - - # Some programs need SUID wrappers, can be configured further or are - # started in user sessions. - # programs.mtr.enable = true; - # programs.gnupg.agent = { - # enable = true; - # enableSSHSupport = true; - # }; - - # List services that you want to enable: - - # Enable the OpenSSH daemon. - # services.openssh.enable = true; - services.openssh = { - enable = true; - settings.PermitRootLogin = "no"; - settings.PasswordAuthentication = false; - }; - - services.superTuxKarts = { - enable = true; - port = 2757; - serverOptions = { - server-name = "LUG STK server"; - server-mode = 0; - server-difficulty = 3; - private-server-password = "lug@uoa"; - motd = "Server for LUG@UoA\nChampionship coming soon!"; - }; - }; - - # Open ports in the firewall. - # networking.firewall.allowedTCPPorts = [ ... ]; - # networking.firewall.allowedUDPPorts = [ ... ]; - # Or disable the firewall altogether. - # networking.firewall.enable = false; - - networking.usePredictableInterfaceNames = false; - networking.useDHCP = false; - networking.interfaces.eth0.useDHCP = true; - - # Copy the NixOS configuration file and link it from the resulting system - # (/run/current-system/configuration.nix). This is useful in case you - # accidentally delete configuration.nix. - # system.copySystemConfiguration = true; - - # This option defines the first version of NixOS you have installed on this particular machine, - # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. - # - # Most users should NEVER change this value after the initial install, for any reason, - # even if you've upgraded your system to a new NixOS release. - # - # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, - # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how - # to actually do that. - # - # This value being lower than the current NixOS release does NOT mean your system is - # out of date, out of support, or vulnerable. - # - # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, - # and migrated your data accordingly. - # - # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . - system.stateVersion = "25.05"; # Did you read the comment? - -} -- cgit v1.2.3