Wireguard on server

2 files changed, 5 insertions, 11 deletions

diff --git a/host/Rory-ovh/configuration.nix b/host/Rory-ovh/configuration.nix

index c31aa11..61d5afc 100755
--- a/host/Rory-ovh/configuration.nix
+++ b/host/Rory-ovh/configuration.nix
@@ -25,6 +25,7 @@
     ./services/matrix/synapse/synapse-main.nix
     ./services/matrix/draupnir.nix
     ./services/email/root.nix
+    ./services/wireguard/wireguard.nix
   ];
 
   users.groups.ocp = { };
diff --git a/host/Rory-ovh/services/wireguard/wireguard.nix b/host/Rory-ovh/services/wireguard/wireguard.nix

index d2f7025..a770603 100644
--- a/host/Rory-ovh/services/wireguard/wireguard.nix
+++ b/host/Rory-ovh/services/wireguard/wireguard.nix
@@ -1,8 +1,5 @@
 { pkgs, ... }:
 {
-  # enable NAT
-  networking.nat.enable = true;
-  networking.nat.externalInterface = "eth0";
   networking.nat.internalInterfaces = [ "wg0" ];
   networking.firewall = {
     allowedUDPPorts = [ 51820 ];
@@ -15,24 +12,20 @@
       listenPort = 51820;
 
       postSetup = ''
-        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o enp98s0f0 -j MASQUERADE
       '';
 
       postShutdown = ''
-        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o enp98s0f0 -j MASQUERADE
       '';
 
-      privateKeyFile = "path to private key file";
+      privateKeyFile = "/data/secrets/wireguard-keys/private";
 
       peers = [
         {
-          publicKey = "{client public key}";
+          publicKey = "WLHEyWxEXRn/T0b9xk/8XJnuoCX0fXxWKHUjZ+AORGQ=";
           allowedIPs = [ "10.100.0.2/32" ];
         }
-        {
-          publicKey = "{john doe's public key}";
-          allowedIPs = [ "10.100.0.3/32" ];
-        }
       ];
     };
   };