Add wireguard vpn config

10 files changed, 45 insertions, 10 deletions

diff --git a/flakes/private/borg_backup/flake.lock b/flakes/private/borg_backup/flake.lock
index 965a940..86ea364 100644
--- a/flakes/private/borg_backup/flake.lock
+++ b/flakes/private/borg_backup/flake.lock
@@ -3,7 +3,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-PQ5694ARRlpj00lk/C/T0UPGhPO+n0TEcLR1mde0s8M=",
+        "narHash": "sha256-TsRuohxw/zmZy1PV2kyraE9VbLULWOyad2jir8O9UbQ=",
         "path": "../environment",
         "type": "path"
       },
diff --git a/flakes/private/chatons/flake.lock b/flakes/private/chatons/flake.lock
index ca16714..14bc263 100644
--- a/flakes/private/chatons/flake.lock
+++ b/flakes/private/chatons/flake.lock
@@ -3,7 +3,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-PQ5694ARRlpj00lk/C/T0UPGhPO+n0TEcLR1mde0s8M=",
+        "narHash": "sha256-TsRuohxw/zmZy1PV2kyraE9VbLULWOyad2jir8O9UbQ=",
         "path": "../environment",
         "type": "path"
       },
diff --git a/flakes/private/environment/flake.nix b/flakes/private/environment/flake.nix
index c389105..9df316d 100644
--- a/flakes/private/environment/flake.nix
+++ b/flakes/private/environment/flake.nix
@@ -165,6 +165,19 @@
                 };
               };
             };
+            wireguard = mkOption {
+              description = "Wireguard key";
+              default = { enable = false; };
+              type = submodule {
+                options = {
+                  enable = mkEnableOption "Enable wireguard";
+                  private = mkOption { type = str; description = "Private key"; };
+                  public = mkOption { type = str; description = "Public key"; };
+                  port = mkOption { type = port; description = "Port"; };
+                  ip = mkOption { type = str; description = "IP"; };
+                };
+              };
+            };
             ips = mkOption {
               description = ''
                 attrs of ip4/ip6 grouped by section
diff --git a/flakes/private/mail-relay/flake.lock b/flakes/private/mail-relay/flake.lock
index 965a940..86ea364 100644
--- a/flakes/private/mail-relay/flake.lock
+++ b/flakes/private/mail-relay/flake.lock
@@ -3,7 +3,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-PQ5694ARRlpj00lk/C/T0UPGhPO+n0TEcLR1mde0s8M=",
+        "narHash": "sha256-TsRuohxw/zmZy1PV2kyraE9VbLULWOyad2jir8O9UbQ=",
         "path": "../environment",
         "type": "path"
       },
diff --git a/flakes/private/milters/flake.lock b/flakes/private/milters/flake.lock
index 77427f4..673c36e 100644
--- a/flakes/private/milters/flake.lock
+++ b/flakes/private/milters/flake.lock
@@ -3,7 +3,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-PQ5694ARRlpj00lk/C/T0UPGhPO+n0TEcLR1mde0s8M=",
+        "narHash": "sha256-TsRuohxw/zmZy1PV2kyraE9VbLULWOyad2jir8O9UbQ=",
         "path": "../environment",
         "type": "path"
       },
diff --git a/flakes/private/monitoring/flake.lock b/flakes/private/monitoring/flake.lock
index eeff363..7f03e17 100644
--- a/flakes/private/monitoring/flake.lock
+++ b/flakes/private/monitoring/flake.lock
@@ -3,7 +3,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-PQ5694ARRlpj00lk/C/T0UPGhPO+n0TEcLR1mde0s8M=",
+        "narHash": "sha256-TsRuohxw/zmZy1PV2kyraE9VbLULWOyad2jir8O9UbQ=",
         "path": "../environment",
         "type": "path"
       },
diff --git a/flakes/private/opendmarc/flake.lock b/flakes/private/opendmarc/flake.lock
index 6947cd3..e212274 100644
--- a/flakes/private/opendmarc/flake.lock
+++ b/flakes/private/opendmarc/flake.lock
@@ -3,7 +3,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-PQ5694ARRlpj00lk/C/T0UPGhPO+n0TEcLR1mde0s8M=",
+        "narHash": "sha256-TsRuohxw/zmZy1PV2kyraE9VbLULWOyad2jir8O9UbQ=",
         "path": "../environment",
         "type": "path"
       },
diff --git a/flakes/private/ssh/flake.lock b/flakes/private/ssh/flake.lock
index 965a940..86ea364 100644
--- a/flakes/private/ssh/flake.lock
+++ b/flakes/private/ssh/flake.lock
@@ -3,7 +3,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-PQ5694ARRlpj00lk/C/T0UPGhPO+n0TEcLR1mde0s8M=",
+        "narHash": "sha256-TsRuohxw/zmZy1PV2kyraE9VbLULWOyad2jir8O9UbQ=",
         "path": "../environment",
         "type": "path"
       },
diff --git a/flakes/private/system/flake.lock b/flakes/private/system/flake.lock
index 60c2dfc..cc104c6 100644
--- a/flakes/private/system/flake.lock
+++ b/flakes/private/system/flake.lock
@@ -19,7 +19,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-PQ5694ARRlpj00lk/C/T0UPGhPO+n0TEcLR1mde0s8M=",
+        "narHash": "sha256-TsRuohxw/zmZy1PV2kyraE9VbLULWOyad2jir8O9UbQ=",
         "path": "../environment",
         "type": "path"
       },
diff --git a/flakes/private/system/flake.nix b/flakes/private/system/flake.nix
index 9010140..775dfcb 100644
--- a/flakes/private/system/flake.nix
+++ b/flakes/private/system/flake.nix
@@ -23,8 +23,30 @@
             permissions = "0400";
           };
 
-          networking.extraHosts = builtins.concatStringsSep "\n"
-            (lib.mapAttrsToList (n: v: "${lib.head v.config.hostEnv.ips.main.ip4} ${n}") nodes);
+          networking.extraHosts = lib.mkMerge [
+            (builtins.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "${lib.head v.config.hostEnv.ips.main.ip4} ${n}") nodes))
+            (builtins.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "${v.config.hostEnv.wireguard.ip} wg-${n}") (lib.filterAttrs (n: v: v.config.hostEnv.wireguard.enable) nodes)))
+          ];
+
+          networking.firewall.allowedUDPPorts = lib.mkIf config.hostEnv.wireguard.enable [ config.hostEnv.wireguard.port ];
+          networking.wg-quick.interfaces.wg0 = lib.mkIf config.hostEnv.wireguard.enable {
+            privateKeyFile = config.secrets.fullPaths."wireguard/private_key";
+            listenPort = config.hostEnv.wireguard.port;
+            address = [
+              "${config.hostEnv.wireguard.ip}/24"
+            ];
+            peers = lib.mapAttrsToList (name: v: {
+              publicKey = v.config.hostEnv.wireguard.public;
+              endpoint = "${name}:${builtins.toString v.config.hostEnv.wireguard.port}";
+              allowedIPs = [ "${v.config.hostEnv.wireguard.ip}/32" ];
+            }) (lib.filterAttrs (n: v: v.config.hostEnv.wireguard.enable) nodes);
+          };
+          secrets.keys."wireguard/private_key" = lib.mkIf config.hostEnv.wireguard.enable {
+            permissions = "0400";
+            text = config.hostEnv.wireguard.private;
+            user = "root";
+            group = "root";
+          };
 
           users.extraUsers.root.openssh.authorizedKeys.keys = [ config.myEnv.sshd.rootKeys.nix_repository ];
           secrets.deleteSecretsVars = true;