jawz/NixOS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update WireGuard configuration to disable secureHost and adjust private key handling

Browse Source 
- Changed secureHost setting from true to false in toggles.nix.
- Modified wireguard-linode.nix to use a default private key path when secureHost is false, enhancing flexibility in key management.
This commit is contained in:
Danilo Reyes 2025-10-28 13:31:40 -06:00
parent 431e145992
commit ac48e8c86b
2 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hosts/linode/toggles.nix
View File

@ -3,7 +3,7 @@ _: {
locale = "en_US.UTF-8"; locale = "en_US.UTF-8";
wireguard.enable = true; wireguard.enable = true;
network.enable = true; network.enable = true;
secureHost = true; secureHost = false;
ips = { ips = {
vps = "51.222.141.104"; vps = "51.222.141.104";
wg-vps = "10.77.0.1"; wg-vps = "10.77.0.1";

8
hosts/linode/wireguard-linode.nix
View File

@ -6,7 +6,7 @@
}: }:
{ {
config = lib.mkIf config.my.services.wireguard.enable { config = lib.mkIf config.my.services.wireguard.enable {
sops.secrets."wireguard/linode/private" = { sops.secrets."wireguard/linode/private" = lib.mkIf config.my.secureHost {
sopsFile = ../../secrets/wireguard.yaml; sopsFile = ../../secrets/wireguard.yaml;
}; };
networking = { networking = {
@ -44,7 +44,11 @@
"${config.my.ips.wg-friends}/24" "${config.my.ips.wg-friends}/24"
]; ];
listenPort = 51820; listenPort = 51820;
privateKeyFile = config.sops.secrets."wireguard/linode/private".path; privateKeyFile =
if config.my.secureHost then
config.sops.secrets."wireguard/linode/private".path
else
"/var/lib/wireguard/private.key";
postSetup = "${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s ${config.my.ips.wg-friends}/24 -o ${ postSetup = "${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s ${config.my.ips.wg-friends}/24 -o ${
config.my.interfaces.${config.networking.hostName} config.my.interfaces.${config.networking.hostName}
} -j MASQUERADE"; } -j MASQUERADE";