Add wireguard server @arrakis

1 files changed, 61 insertions, 1 deletions

diff --git a/hosts/arrakis/default.nix b/hosts/arrakis/default.nix
index 06b1f2b..f9277f8 100644
--- a/hosts/arrakis/default.nix
+++ b/hosts/arrakis/default.nix
@@ -63,6 +63,57 @@
     nameservers = [ "192.168.1.1" ];
     nftables.enable = true;
     useDHCP = false;
+    wg-quick.interfaces = {
+      wg0 = {
+        address = [
+          "10.4.20.1/24"
+        ];
+        ListenPort = 51820;
+        peers = [
+          { # black-sheep
+            allowedIPs = [ "10.4.20.2/32" ];
+            presharedKeyFile = "${config.sops.secrets."wireguard/black-sheep_psk".path}";
+            publicKey = "wQsGWsfXI2+GmKHdCH2V2xIeTyV2YlH/IFp6gerxcW8=";
+          }
+          { # lilnasx
+            allowedIPs = [ "10.4.20.3/32" ];
+            presharedKeyFile = "${config.sops.secrets."wireguard/lilnasx_psk".path}";
+            publicKey = "87cANtuPf28vGrB0uL69/tXgsD/30FUYt/XevQjpz3o=";
+          }
+          { # ramped
+            allowedIPs = [ "10.4.20.4/32" ];
+            presharedKeyFile = "${config.sops.secrets."wireguard/ramped_psk".path}";
+            publicKey = "TvE3f0QKJXUn8pxmKMaztFvRIdi9z9dxNDN2KNdtRXQ=";
+          }
+          { # homer
+            allowedIPs = [ "10.4.20.5/32" ];
+            presharedKeyFile = "${config.sops.secrets."wireguard/homer_psk".path}";
+            publicKey = "FBc2ZnypwHgjLQcZrwzPR35gax8JsXLa1ZcZy6iAc3Q=";
+          }
+          { # treebeard
+            allowedIPs = [ "10.4.20.6/32" ];
+            presharedKeyFile = "${config.sops.secrets."wireguard/treebeard_psk".path}";
+            publicKey = "aYh7q1QNmz6TLYx5OsZcyHQe45Dv0SyIOCtRp1NHDU8=";
+          }
+          { # lolli
+            allowedIPs = [ "10.4.20.7/32" ];
+            presharedKeyFile = "${config.sops.secrets."wireguard/lolli_psk".path}";
+            publicKey = "npt86Lt/f/9J3qS6u6C0X1MFHIONaA5PKE6lzwwUxTc=";
+          }
+          { # timetrad
+            allowedIPs = [ "10.4.20.8/32" ];
+            presharedKeyFile = "${config.sops.secrets."wireguard/timetrad_psk".path}";
+            publicKey = "/lWCEMGRIr3Gl/3GQYuweAKylhH5H2KqamiXeocYFVM=";
+          }
+          { # ginaz
+            allowedIPs = [ "10.4.20.254/32" ];
+            presharedKeyFile = "${config.sops.secrets."wireguard/ginaz_psk".path}";
+            publicKey = "GuE9PVeS0IDTcaBxOSJmKlvEx2xflxwVGOU+uM0HhBk=";
+          }
+        ];
+        privateKeyFile = "${config.sops.secrets."wireguard/arrakis_key".path}";
+      };
+    };
     wireless = {
       enable = true;
       networks = {
@@ -70,7 +121,7 @@
           pskRaw = "ext:psk_crystal_palace";
         };
       };
-      secretsFile = "/run/secrets/wpa_supplicant";
+      secretsFile = "${config.sops.secrets."wpa_supplicant".path}";
     };
   };
 
@@ -83,6 +134,15 @@
 
     secrets = {
       "nftables/ssh" = {};
+      "wireguard/arrakis_key" = {};
+      "wireguard/black-sheep_psk" = {};
+      "wireguard/ginaz_psk" = {};
+      "wireguard/homer_psk" = {};
+      "wireguard/lilnasx_psk" = {};
+      "wireguard/lolli_psk" = {};
+      "wireguard/ramped_psk" = {};
+      "wireguard/timetrad_psk" = {};
+      "wireguard/treebeard_psk" = {};
       "wpa_supplicant" = {};
     };
   };