alexion/dev
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(nixos): centralize VPN controls #142

Merged
alexion merged 1 commits from refactor/consolidate-vpn-client into main 2026-10-07 22:44:59 -04:00
Conversation 0 Commits 1 Files Changed 2 +19 -55
2 changed files with 19 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
configs/nixos/hosts/neogaia/default.nix
View File

@@ -27,15 +27,9 @@
peer = { peer = {
publicKey = "sGEkSD+gEdIMXi4PBN3AhwHGc4tWMtcjOIey3s7yb3I="; publicKey = "sGEkSD+gEdIMXi4PBN3AhwHGc4tWMtcjOIey3s7yb3I=";
endpoint = "100.0.90.192:51820"; endpoint = "100.0.90.192:51820";
allowedIPs = [ "10.23.0.0/16" ];
}; };
}; };
registry.shell-shortcut.neogaia = {
vpn-on = "sudo systemctl start wireguard-wg-home.target";
vpn-off = "sudo systemctl stop 'wireguard-wg-home*.service' wireguard-wg-home.target";
};
modules.monorepo.enable = true; modules.monorepo.enable = true;
modules.shell.herdr.enable = true; modules.shell.herdr.enable = true;
modules.shell.gitea-axi.enable = true; modules.shell.gitea-axi.enable = true;

68
configs/nixos/modules/network/vpn-client.nix
View File

@@ -13,61 +13,31 @@ in
interface = lib.mkOption { interface = lib.mkOption {
type = lib.types.str; type = lib.types.str;
default = "wg-home"; default = "wg-home";
description = "WireGuard interface name."; description = "Names the WireGuard interface.";
}; };
address = lib.mkOption { address = lib.mkOption {
type = lib.types.str; type = lib.types.str;
example = "10.23.100.3/32"; example = "10.23.100.3/32";
description = "Client tunnel address in CIDR notation."; description = "Sets the client tunnel address in CIDR notation.";
};
privateKeySecret = lib.mkOption {
type = lib.types.str;
default = "wireguard-home-private-key";
description = "SOPS secret containing the WireGuard client private key.";
};
autoStart = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Whether to start the VPN tunnel during boot.";
};
mtu = lib.mkOption {
type = lib.types.nullOr lib.types.int;
default = 1280;
description = "Tunnel MTU, or null to use the WireGuard default.";
}; };
sopsFile = lib.mkOption { sopsFile = lib.mkOption {
type = lib.types.nullOr lib.types.path; type = lib.types.nullOr lib.types.path;
default = null; default = null;
description = "Encrypted secrets file that contains privateKeySecret."; description = "Names the encrypted file that contains the WireGuard private key.";
}; };
peer = { peer = {
publicKey = lib.mkOption { publicKey = lib.mkOption {
type = lib.types.str; type = lib.types.str;
description = "WireGuard public key for the remote peer."; description = "Sets the WireGuard public key for the remote peer.";
}; };
endpoint = lib.mkOption { endpoint = lib.mkOption {
type = lib.types.str; type = lib.types.str;
example = "203.0.113.10:51820"; example = "203.0.113.10:51820";
description = "WireGuard endpoint for the remote peer."; description = "Sets the WireGuard endpoint for the remote peer.";
};
allowedIPs = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ "10.23.0.0/16" ];
description = "Routes to send through the VPN tunnel.";
};
persistentKeepalive = lib.mkOption {
type = lib.types.nullOr lib.types.int;
default = 25;
description = "Persistent keepalive interval in seconds, or null to disable it.";
}; };
}; };
}; };
@@ -76,30 +46,30 @@ in
assertions = [ assertions = [
{ {
assertion = cfg.sopsFile != null; assertion = cfg.sopsFile != null;
message = "modules.network.vpn-client.sopsFile must name the encrypted secrets file containing the WireGuard private key."; message = "Set modules.network.vpn-client.sopsFile when the VPN client is enabled.";
} }
]; ];
sops.secrets.${cfg.privateKeySecret}.sopsFile = cfg.sopsFile; sops.secrets.wireguard-home-private-key.sopsFile = cfg.sopsFile;
systemd.targets."wireguard-${cfg.interface}" = lib.mkIf (!cfg.autoStart) { registry.shell-shortcut.${config.networking.hostName} = {
wantedBy = lib.mkForce [ ]; vpn-on = "sudo systemctl start wireguard-${cfg.interface}.target";
vpn-off = "sudo systemctl stop 'wireguard-${cfg.interface}*.service' wireguard-${cfg.interface}.target";
}; };
systemd.targets."wireguard-${cfg.interface}".wantedBy = lib.mkForce [ ];
networking.wireguard.interfaces.${cfg.interface} = { networking.wireguard.interfaces.${cfg.interface} = {
ips = [ cfg.address ]; ips = [ cfg.address ];
inherit (cfg) mtu; mtu = 1280;
privateKeyFile = config.sops.secrets.${cfg.privateKeySecret}.path; privateKeyFile = config.sops.secrets.wireguard-home-private-key.path;
peers = [ peers = [
( {
{ inherit (cfg.peer) publicKey endpoint;
inherit (cfg.peer) publicKey endpoint allowedIPs; allowedIPs = [ "10.23.0.0/16" ];
} persistentKeepalive = 25;
// lib.optionalAttrs (cfg.peer.persistentKeepalive != null) { }
inherit (cfg.peer) persistentKeepalive;
}
)
]; ];
}; };
}; };