Wireguard

1 files changed, 48 insertions, 0 deletions

diff --git a/hosts/pihlaja/default.nix b/hosts/pihlaja/default.nix
index 54a7efd..fd0a1b1 100644
--- a/hosts/pihlaja/default.nix
+++ b/hosts/pihlaja/default.nix
@@ -230,5 +230,53 @@
     });
   '';
 
+  age.secrets.wg_relesoft = {
+    file = ../../secrets/wg_relesoft_pihlaja.age;
+    group = "systemd-network";
+    mode = "0640";
+  };
+
+  systemd.network.netdevs."90-wg-relesoft" = {
+    netdevConfig = {
+      Name = "wg-relesoft";
+      Kind = "wireguard";
+    };
+    wireguardConfig = {
+      PrivateKeyFile = config.age.secrets.wg_relesoft.path;
+    };
+    wireguardPeers = [
+      {
+        PublicKey = "B5QK7rl8sAXPu2upKhondWSt49qMOqTG/hDjwqY3cDs=";
+        Endpoint = "65.21.238.221:51194";
+        AllowedIPs = [
+          "10.200.200.0/24"
+          "fdc9:281f:4d7:9ee9::/64"
+          "2a01:4f9:6a:4e26::/64"
+        ];
+        PersistentKeepalive = 25;
+      }
+    ];
+  };
+
+  systemd.network.networks."90-wg-relesoft" = {
+    matchConfig.Name = "wg-relesoft";
+    address = [
+      "10.200.200.10/24"
+      "fdc9:281f:4d7:9ee9::10/128"
+      "2a01:4f9:6a:4e26::10/128"
+    ];
+    networkConfig = {
+      IPv4Forwarding = true;
+      IPv6Forwarding = true;
+      IPv6AcceptRA = false;
+    };
+    routes = [
+      { Destination = "10.200.200.0/24"; }
+      { Destination = "fdc9:281f:4d7:9ee9::/64"; }
+      { Destination = "2a01:4f9:6a:4e26::/64"; }
+    ];
+    linkConfig.MTUBytes = "1420";
+  };
+
   system.stateVersion = "24.05"; # Did you read the comment?
 }