alexion/dev
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(nixos): fix VPN client settings

Browse Source
This commit is contained in:
alexion
2026-10-07 22:43:36 -04:00
parent 22bbd5e2b4
commit 3395060db4
1 changed files with 15 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
configs/nixos/modules/network/vpn-client.nix
View File

@@ -13,61 +13,31 @@ in
interface = lib.mkOption {
type = lib.types.str;
default = "wg-home";
description = "WireGuard interface name.";
description = "Names the WireGuard interface.";
};
address = lib.mkOption {
type = lib.types.str;
example = "10.23.100.3/32";
description = "Client tunnel address in CIDR notation.";
};
privateKeySecret = lib.mkOption {
type = lib.types.str;
default = "wireguard-home-private-key";
description = "SOPS secret containing the WireGuard client private key.";
};
autoStart = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Whether to start the VPN tunnel during boot.";
};
mtu = lib.mkOption {
type = lib.types.nullOr lib.types.int;
default = 1280;
description = "Tunnel MTU, or null to use the WireGuard default.";
description = "Sets the client tunnel address in CIDR notation.";
};
sopsFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = "Encrypted secrets file that contains privateKeySecret.";
description = "Names the encrypted file that contains the WireGuard private key.";
};
peer = {
publicKey = lib.mkOption {
type = lib.types.str;
description = "WireGuard public key for the remote peer.";
description = "Sets the WireGuard public key for the remote peer.";
};
endpoint = lib.mkOption {
type = lib.types.str;
example = "203.0.113.10:51820";
description = "WireGuard endpoint for the remote peer.";
};
allowedIPs = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ "10.23.0.0/16" ];
description = "Routes to send through the VPN tunnel.";
};
persistentKeepalive = lib.mkOption {
type = lib.types.nullOr lib.types.int;
default = 25;
description = "Persistent keepalive interval in seconds, or null to disable it.";
description = "Sets the WireGuard endpoint for the remote peer.";
};
};
};
@@ -76,35 +46,30 @@ in
assertions = [
{
assertion = cfg.sopsFile != null;
message = "modules.network.vpn-client.sopsFile must name the encrypted secrets file containing the WireGuard private key.";
message = "Set modules.network.vpn-client.sopsFile when the VPN client is enabled.";
}
];
sops.secrets.${cfg.privateKeySecret}.sopsFile = cfg.sopsFile;
sops.secrets.wireguard-home-private-key.sopsFile = cfg.sopsFile;
registry.shell-shortcut.${config.networking.hostName} = {
vpn-on = "sudo systemctl start wireguard-${cfg.interface}.target";
vpn-off = "sudo systemctl stop 'wireguard-${cfg.interface}*.service' wireguard-${cfg.interface}.target";
};
systemd.targets."wireguard-${cfg.interface}" = lib.mkIf (!cfg.autoStart) {
wantedBy = lib.mkForce [ ];
};
systemd.targets."wireguard-${cfg.interface}".wantedBy = lib.mkForce [ ];
networking.wireguard.interfaces.${cfg.interface} = {
ips = [ cfg.address ];
inherit (cfg) mtu;
privateKeyFile = config.sops.secrets.${cfg.privateKeySecret}.path;
mtu = 1280;
privateKeyFile = config.sops.secrets.wireguard-home-private-key.path;
peers = [
(
{
inherit (cfg.peer) publicKey endpoint allowedIPs;
}
// lib.optionalAttrs (cfg.peer.persistentKeepalive != null) {
inherit (cfg.peer) persistentKeepalive;
}
)
{
inherit (cfg.peer) publicKey endpoint;
allowedIPs = [ "10.23.0.0/16" ];
persistentKeepalive = 25;
}
];
};
};