sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: move wireguard module to nixos-extra-modules

Browse source
This commit is contained in:
oddlama 2024-03-14 20:55:08 +01:00
parent 621d725af3
commit a4844807e6
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
27 changed files with 73 additions and 783 deletions
Download patch file Download diff file Expand all files Collapse all files

3
hosts/sentinel/default.nix
View file

@ -15,6 +15,7 @@
boot.mode = "bios";
users.groups.acme.members = ["nginx"];
wireguard.proxy-sentinel.firewallRuleForAll.allowedTCPPorts = [80 443];
services.nginx.enable = true;
services.nginx.recommendedSetup = true;
@ -24,7 +25,7 @@
};
# Connect safely via wireguard to skip authentication
networking.hosts.${config.meta.wireguard.proxy-sentinel.ipv4} = [config.networking.providedDomains.influxdb];
networking.hosts.${config.wireguard.proxy-sentinel.ipv4} = [config.networking.providedDomains.influxdb];
meta.telegraf = {
enable = true;
scrapeSensors = false;

17
hosts/sentinel/net.nix
View file

@ -34,23 +34,12 @@
};
};
networking.nftables.firewall = {
zones = {
untrusted.interfaces = ["wan"];
proxy-sentinel.interfaces = ["proxy-sentinel"];
};
# Allow accessing nginx through the proxy
rules.proxy-sentinel-to-local = {
from = ["proxy-sentinel"];
to = ["local"];
allowedTCPPorts = [80 443];
};
};
networking.nftables.firewall.zones.untrusted.interfaces = ["wan"];
meta.wireguard.proxy-sentinel.server = {
wireguard.proxy-sentinel.server = {
host = config.networking.fqdn;
port = 51443;
reservedAddresses = ["10.43.0.0/24" "fd00:43::/120"];
openFirewallRules = ["untrusted-to-local"];
openFirewall = true;
};
}