clerie
/
nixfiles
1
0
Fork 0
Code

hosts/beryllium: add management tunnel

This commit is contained in:
clerie 2022-12-29 17:02:22 +01:00
parent 8e96523837
commit b3ef4e6bde
2 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
hosts/beryllium/configuration.nix
View File

@ -20,6 +20,36 @@
networking.hostName = "beryllium";
petabyte.policyrouting = {
enable = true;
rules6 = [
{ rule = "from 2a01:4f8:c0c:15f1::8107/128 lookup 200"; prio = 20000; }
{ rule = "from 2a01:4f8:c0c:15f1::8107/128 unreachable"; prio = 20001; }
];
rules4 = [
{ rule = "from 10.20.30.107/32 lookup 200"; prio = 20000; }
{ rule = "from 10.20.30.107/32 unreachable"; prio = 20001; }
];
};
networking.wireguard.enable = true;
networking.wireguard.interfaces = {
wg-clerie = {
ips = [ "2a01:4f8:c0c:15f1::8107/128" "10.20.30.107/32" ];
table = "200";
peers = [
{
endpoint = "vpn.clerie.de:51820";
persistentKeepalive = 25;
allowedIPs = [ "0.0.0.0/0" "::/0" "10.20.30.0/24" "2a01:4f8:c0c:15f1::/113" ];
publicKey = "2p1Jqs3bkXbXHFWE6vp1yxHIFoUaZQEARS2nJzbkuBA=";
}
];
privateKeyFile = "/var/src/secrets/wireguard/wg-clerie";
};
};
clerie.monitoring = {
enable = true;
id = "213";

5
hosts/gatekeeper/configuration.nix
View File

@ -88,6 +88,11 @@
allowedIPs = [ "2a01:4f8:c0c:15f1::8106/128" "10.20.30.106/32" ];
publicKey = "kuUeStBuU6d8PGFHFhP5pEvy0nuZ0TmScI8w7MOt0is=";
}
{
# beryllium
allowedIPs = [ "2a01:4f8:c0c:15f1::8107/128" "10.20.30.107/32" ];
publicKey = "SReFUcvw/4fLSkFGjkhDRyY9wyMCcjJ4Yiczt9X64Eo=";
}
];
listenPort = 51820;
allowedIPsAsRoutes = false;