caspervk/nixos
1
0
Fork 0
Code Actions Activity

hide sigma-p2p address

Browse source
This commit is contained in:
Casper V. Kristensen 2024-03-29 20:36:24 +01:00
parent e33a9538fb
commit 6c947dca0c
3 changed files with 15 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
flake.lock
View file

@ -165,11 +165,11 @@
}, },
"secrets": { "secrets": {
"locked": { "locked": {
"lastModified": 1711641020, "lastModified": 1711740735,
"narHash": "sha256-und6yndmaPsS/wEkqrEvN02VbK+HCFz0zglRNaZeCJI=", "narHash": "sha256-/NmklXfLak65luQoMsUl539faoabD+lo7P9fNDaXkic=",
"ref": "refs/heads/master", "ref": "refs/heads/master",
"rev": "057f8a2b8cd29a70764004d035a6a9e33c73f4ff", "rev": "42e5e76765daf6dd36fa195a5a424d8d69c15dfa",
"revCount": 5, "revCount": 6,
"type": "git", "type": "git",
"url": "ssh://git@git.caspervk.net/caspervk/nixos-secrets.git" "url": "ssh://git@git.caspervk.net/caspervk/nixos-secrets.git"
}, },

8
hosts/alpha/network.nix
View file

@ -45,9 +45,9 @@
name = "wg-sigma-public"; name = "wg-sigma-public";
}; };
# The following routes traffic destined for 116.203.6.156 (floating IP) to # The following routes traffic destined for the sigma-p2p address (floating
# sigma through wireguard. This allows the server to have a public address # IP) to sigma through wireguard. This allows the server to have a public
# and help others sail the high seas even though it is behind NAT. # address and help others sail the high seas even though it is behind NAT.
netdevs."51-wg-sigma-p2p" = { netdevs."51-wg-sigma-p2p" = {
netdevConfig = { netdevConfig = {
Name = "wg-sigma-p2p"; Name = "wg-sigma-p2p";
@ -62,7 +62,7 @@
wireguardPeerConfig = { wireguardPeerConfig = {
PublicKey = "sigmaH/DKSU8KWyrPtucYmS2ewUvDvCNLxd/qYEo0n0="; PublicKey = "sigmaH/DKSU8KWyrPtucYmS2ewUvDvCNLxd/qYEo0n0=";
PresharedKeyFile = config.age.secrets.wireguard-preshared-key-file.path; PresharedKeyFile = config.age.secrets.wireguard-preshared-key-file.path;
AllowedIPs = ["116.203.6.156/32"]; AllowedIPs = ["${secrets.alpha.sigma-p2p-ip-address}/32"];
RouteTable = "main"; RouteTable = "main";
}; };
} }

14
hosts/omega/network.nix
View file

@ -6,8 +6,8 @@
systemd.network = { systemd.network = {
config = { config = {
routeTables = { routeTables = {
"wg-sigma-public" = 822944075; "wg-sigma-public" = 42;
"wg-sigma-p2p" = 2553; "wg-sigma-p2p" = 6881;
}; };
}; };
@ -59,9 +59,9 @@
}; };
# The following establishes a wireguard tunnel to alpha and configures # The following establishes a wireguard tunnel to alpha and configures
# receiving traffic destined for 116.203.6.156. This allows the server to # receiving traffic destined for the sigma-p2p address. This allows the
# have a public address and help others sail the high seas even though it # server to have a public address and help others sail the high seas even
# is behind NAT. # though it is behind NAT.
netdevs."51-wg-sigma-p2p" = { netdevs."51-wg-sigma-p2p" = {
netdevConfig = { netdevConfig = {
Name = "wg-sigma-p2p"; Name = "wg-sigma-p2p";
@ -85,11 +85,11 @@
}; };
networks."wg-sigma-p2p" = { networks."wg-sigma-p2p" = {
name = "wg-sigma-p2p"; name = "wg-sigma-p2p";
address = ["116.203.6.156/32"]; address = ["${secrets.sigma.sigma-p2p-ip-address}/32"];
routingPolicyRules = [ routingPolicyRules = [
{ {
routingPolicyRuleConfig = { routingPolicyRuleConfig = {
From = "116.203.6.156/32"; From = "${secrets.sigma.sigma-p2p-ip-address}/32";
Table = "wg-sigma-p2p"; Table = "wg-sigma-p2p";
}; };
} }