alexion/dev
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(nixos): fix VPN client settings

Browse Source
This commit is contained in:
alexion
2026-10-07 22:43:36 -04:00
parent 22bbd5e2b4
commit 3395060db4
1 changed files with 15 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
configs/nixos/modules/network/vpn-client.nix
View File

@@ -13,61 +13,31 @@ in
interface = lib.mkOption { interface = lib.mkOption {
type = lib.types.str; type = lib.types.str;
default = "wg-home"; default = "wg-home";
description = "WireGuard interface name."; description = "Names the WireGuard interface.";
}; };
address = lib.mkOption { address = lib.mkOption {
type = lib.types.str; type = lib.types.str;
example = "10.23.100.3/32"; example = "10.23.100.3/32";
description = "Client tunnel address in CIDR notation."; description = "Sets the client tunnel address in CIDR notation.";
};
privateKeySecret = lib.mkOption {
type = lib.types.str;
default = "wireguard-home-private-key";
description = "SOPS secret containing the WireGuard client private key.";
};
autoStart = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Whether to start the VPN tunnel during boot.";
};
mtu = lib.mkOption {
type = lib.types.nullOr lib.types.int;
default = 1280;
description = "Tunnel MTU, or null to use the WireGuard default.";
}; };
sopsFile = lib.mkOption { sopsFile = lib.mkOption {
type = lib.types.nullOr lib.types.path; type = lib.types.nullOr lib.types.path;
default = null; default = null;
description = "Encrypted secrets file that contains privateKeySecret."; description = "Names the encrypted file that contains the WireGuard private key.";
}; };
peer = { peer = {
publicKey = lib.mkOption { publicKey = lib.mkOption {
type = lib.types.str; type = lib.types.str;
description = "WireGuard public key for the remote peer."; description = "Sets the WireGuard public key for the remote peer.";
}; };
endpoint = lib.mkOption { endpoint = lib.mkOption {
type = lib.types.str; type = lib.types.str;
example = "203.0.113.10:51820"; example = "203.0.113.10:51820";
description = "WireGuard endpoint for the remote peer."; description = "Sets the WireGuard endpoint for the remote peer.";
};
allowedIPs = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ "10.23.0.0/16" ];
description = "Routes to send through the VPN tunnel.";
};
persistentKeepalive = lib.mkOption {
type = lib.types.nullOr lib.types.int;
default = 25;
description = "Persistent keepalive interval in seconds, or null to disable it.";
}; };
}; };
}; };
@@ -76,35 +46,30 @@ in
assertions = [ assertions = [
{ {
assertion = cfg.sopsFile != null; assertion = cfg.sopsFile != null;
message = "modules.network.vpn-client.sopsFile must name the encrypted secrets file containing the WireGuard private key."; message = "Set modules.network.vpn-client.sopsFile when the VPN client is enabled.";
} }
]; ];
sops.secrets.${cfg.privateKeySecret}.sopsFile = cfg.sopsFile; sops.secrets.wireguard-home-private-key.sopsFile = cfg.sopsFile;
registry.shell-shortcut.${config.networking.hostName} = { registry.shell-shortcut.${config.networking.hostName} = {
vpn-on = "sudo systemctl start wireguard-${cfg.interface}.target"; vpn-on = "sudo systemctl start wireguard-${cfg.interface}.target";
vpn-off = "sudo systemctl stop 'wireguard-${cfg.interface}*.service' wireguard-${cfg.interface}.target"; vpn-off = "sudo systemctl stop 'wireguard-${cfg.interface}*.service' wireguard-${cfg.interface}.target";
}; };
systemd.targets."wireguard-${cfg.interface}" = lib.mkIf (!cfg.autoStart) { systemd.targets."wireguard-${cfg.interface}".wantedBy = lib.mkForce [ ];
wantedBy = lib.mkForce [ ];
};
networking.wireguard.interfaces.${cfg.interface} = { networking.wireguard.interfaces.${cfg.interface} = {
ips = [ cfg.address ]; ips = [ cfg.address ];
inherit (cfg) mtu; mtu = 1280;
privateKeyFile = config.sops.secrets.${cfg.privateKeySecret}.path; privateKeyFile = config.sops.secrets.wireguard-home-private-key.path;
peers = [ peers = [
( {
{ inherit (cfg.peer) publicKey endpoint;
inherit (cfg.peer) publicKey endpoint allowedIPs; allowedIPs = [ "10.23.0.0/16" ];
} persistentKeepalive = 25;
// lib.optionalAttrs (cfg.peer.persistentKeepalive != null) { }
inherit (cfg.peer) persistentKeepalive;
}
)
]; ];
}; };
}; };