rouven.seifert/nixos-config
1
1
Fork 0
mirror of https://git.sr.ht/~rouven/nixos-config synced 2025-04-25 16:08:30 +02:00
Code Issues Projects Releases Packages Wiki Activity

wireguard and fail2ban

Browse source
This commit is contained in:
Rouven Seifert 2023-10-22 15:45:30 +02:00
parent 78a47101ac
commit 5148ff5953
Signed by: rouven.seifert
GPG key ID: B95E8FE6B11C4D09
15 changed files with 132 additions and 67 deletions
Download patch file Download diff file Expand all files Collapse all files

22
hosts/thinkpad/modules/networks/default.nix
View file

@ -55,8 +55,8 @@
matchConfig.Name = "lo";
linkConfig.RequiredForOnline = false;
};
networks."10-wired" = {
matchConfig.Name = "enp0s31f6";
networks."10-wired-default" = {
matchConfig.Name = "en*";
linkConfig.RequiredForOnline = false;
networkConfig = {
DHCP = "yes";
@ -102,11 +102,10 @@
};
# some wireguard interfaces
netdevs."30-dorm" = {
netdevs."30-wg0" = {
netdevConfig = {
Kind = "wireguard";
Name = "dorm";
Description = "WireGuard to my Dorm Infra";
Name = "wg0";
};
wireguardConfig = {
PrivateKeyFile = config.sops.secrets."wireguard/dorm/private".path;
@ -118,28 +117,27 @@
PublicKey = "Z5lwwHTCDr6OF4lfaCdSHNveunOn4RzuOQeyB+El9mQ=";
PresharedKeyFile = config.sops.secrets."wireguard/dorm/preshared".path;
Endpoint = "141.30.227.6:51820";
# Endpoint = "dorm.vpn.rfive.de:51820";
AllowedIPs = "192.168.2.0/24, 192.168.1.0/24";
AllowedIPs = "192.168.42.0/24, 192.168.43.0/24";
};
}
];
};
networks."30-dorm" = {
matchConfig.Name = "dorm";
networks."30-wg0" = {
matchConfig.Name = "wg0";
networkConfig = {
DNS = "192.168.1.1";
DNS = "192.168.42.1";
};
addresses = [
{
addressConfig = {
Address = "192.168.2.3/24";
Address = "192.168.43.3/24";
RouteMetric = 30;
};
}
];
routes = [
# allowedIPs is somewhat broken
{ routeConfig = { Gateway = "0.0.0.0"; Destination = "192.168.1.0/24"; Metric = 30; }; }
{ routeConfig = { Gateway = "0.0.0.0"; Destination = "192.168.42.0/24"; Metric = 30; }; }
];
};
};

14
hosts/thinkpad/modules/networks/uni.nix
View file

@ -25,6 +25,20 @@
ca_cert="/etc/ssl/certs/ca-certificates.crt"
domain_suffix_match="radius.agdsn.de"
identity="r5"
password="@AGDSN_WIFI_AUTH@"
phase2="auth=PAP"
'';
authProtocols = [ "WPA-EAP" ];
};
agdsn-office = {
auth = ''
eap=TTLS
anonymous_identity="wifi@agdsn.de"
ca_cert="/etc/ssl/certs/ca-certificates.crt"
domain_suffix_match="radius.agdsn.de"
identity="r5"
priority=5
proto=WPA2
password="@AGDSN_AUTH@"
phase2="auth=PAP"
'';