sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: move wireguard module to nixos-extra-modules

Browse source
This commit is contained in:
oddlama 2024-03-14 20:55:08 +01:00
parent 621d725af3
commit a4844807e6
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
27 changed files with 73 additions and 783 deletions
Download patch file Download diff file Expand all files Collapse all files

17
hosts/ward/guests/forgejo.nix
View file

@ -8,9 +8,10 @@
sentinelCfg = nodes.sentinel.config;
forgejoDomain = "git.${config.repo.secrets.global.domains.me}";
in {
meta.wireguard-proxy.sentinel.allowedTCPPorts = [
config.services.forgejo.settings.server.HTTP_PORT
];
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [config.services.forgejo.settings.server.HTTP_PORT];
};
age.secrets.forgejo-mailer-password = {
rekeyFile = config.node.secretsDir + "/forgejo-mailer-password.age";
@ -37,22 +38,22 @@ in {
postrouting.to-forgejo = {
after = ["hook"];
rules = [
"iifname wan ip daddr ${config.meta.wireguard.proxy-sentinel.ipv4} tcp dport 22 masquerade random"
"iifname wan ip6 daddr ${config.meta.wireguard.proxy-sentinel.ipv6} tcp dport 22 masquerade random"
"iifname wan ip daddr ${config.wireguard.proxy-sentinel.ipv4} tcp dport 22 masquerade random"
"iifname wan ip6 daddr ${config.wireguard.proxy-sentinel.ipv6} tcp dport 22 masquerade random"
];
};
prerouting.to-forgejo = {
after = ["hook"];
rules = [
"iifname wan tcp dport 9922 dnat ip to ${config.meta.wireguard.proxy-sentinel.ipv4}:22"
"iifname wan tcp dport 9922 dnat ip6 to ${config.meta.wireguard.proxy-sentinel.ipv6}:22"
"iifname wan tcp dport 9922 dnat ip to ${config.wireguard.proxy-sentinel.ipv4}:22"
"iifname wan tcp dport 9922 dnat ip6 to ${config.wireguard.proxy-sentinel.ipv6}:22"
];
};
};
services.nginx = {
upstreams.forgejo = {
servers."${config.meta.wireguard.proxy-sentinel.ipv4}:${toString config.services.forgejo.settings.server.HTTP_PORT}" = {};
servers."${config.wireguard.proxy-sentinel.ipv4}:${toString config.services.forgejo.settings.server.HTTP_PORT}" = {};
extraConfig = ''
zone forgejo 64k;
keepalive 2;