81 lines
2.7 KiB
Nix
81 lines
2.7 KiB
Nix
{pkgs, ...}: let
|
|
# sops-encrypted secrets (single file holds all service secrets), same as backup.nix.
|
|
secretsFile = ../../secrets/secrets.yaml;
|
|
# Root-only env file wg-easy reads the admin password from (0600 root).
|
|
wgEnvFile = "/var/lib/wg-easy/environment";
|
|
|
|
# Materialize the wg-easy admin password from sops into a root-only env file,
|
|
# so the secret never lands in the Nix store.
|
|
writeSecrets = pkgs.writeShellScript "wg-easy-write-secrets" ''
|
|
set -euo pipefail
|
|
mkdir -p "$(dirname ${wgEnvFile})"
|
|
PASSWORD="$(${pkgs.sops}/bin/sops \
|
|
--decrypt --extract '["wg_admin_password"]' \
|
|
--input-type yaml --output-type yaml ${secretsFile} | tr -d '\n')"
|
|
printf 'INIT_PASSWORD=%s\n' "$PASSWORD" > "${wgEnvFile}"
|
|
chmod 0600 "${wgEnvFile}"
|
|
'';
|
|
in {
|
|
boot.kernelModules = ["ip6table_nat"];
|
|
|
|
virtualisation.oci-containers.containers.wg-easy = {
|
|
image = "ghcr.io/wg-easy/wg-easy:15";
|
|
autoStart = true;
|
|
volumes = [
|
|
"/home/admin/config:/etc/wireguard:Z"
|
|
];
|
|
environmentFiles = [wgEnvFile];
|
|
environment = {
|
|
INSECURE = "true";
|
|
INIT_ENABLED = "true";
|
|
INIT_USERNAME = "admin";
|
|
INIT_HOST = "severijnse.eu";
|
|
INIT_PORT = "51820";
|
|
INIT_DNS = "1.1.1.1,2606:4700:4700::1111";
|
|
INIT_IPV4_CIDR = "10.8.0.0/24";
|
|
INIT_IPV6_CIDR = "fd10:8::/64";
|
|
INIT_ALLOWED_IPS = "0.0.0.0/0, ::/0";
|
|
};
|
|
extraOptions = [
|
|
"--cap-add=NET_ADMIN"
|
|
"--cap-add=SYS_MODULE"
|
|
"--cap-add=NET_RAW"
|
|
"--network=host"
|
|
];
|
|
};
|
|
|
|
# Materialize the wg-easy admin password from sops before the container starts.
|
|
systemd.services.wg-easy-secrets = {
|
|
description = "Materialize wg-easy admin password from sops";
|
|
wantedBy = ["multi-user.target"];
|
|
# The age key lives in /etc/age/keys.txt; the service must know where it is
|
|
# and needs a HOME for age to report its user config directory.
|
|
environment.SOPS_AGE_KEY_FILE = "/etc/age/keys.txt";
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
Environment = ["HOME=/root"];
|
|
ExecStart = "${writeSecrets}";
|
|
};
|
|
};
|
|
|
|
systemd.services."podman-wg-easy" = {
|
|
requires = ["wg-easy-secrets.service"];
|
|
after = ["wg-easy-secrets.service"];
|
|
};
|
|
|
|
systemd.services.wg-nat66 = {
|
|
description = "NAT66 for WireGuard IPv6";
|
|
after = ["network.target" "podman-wg-easy.service"];
|
|
wants = ["podman-wg-easy.service"];
|
|
wantedBy = ["multi-user.target"];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
};
|
|
script = ''
|
|
${pkgs.iptables}/bin/ip6tables -t nat -C POSTROUTING -s fd10:8::/64 -o enp1s0 -j MASQUERADE 2>/dev/null || \
|
|
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fd10:8::/64 -o enp1s0 -j MASQUERADE
|
|
'';
|
|
};
|
|
}
|