muon/flake
1
0
Fork 0
mirror of https://codeberg.org/muon/home.git synced 2025-12-06 08:07:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add wireguard

Browse source
This commit is contained in:
muon 2024-08-27 21:50:43 +00:00
parent 4dc3200d68
commit 86e4bf1c4e
10 changed files with 156 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

4
modules/nixos/server/containers/steam.nix
View file

@ -20,8 +20,8 @@ in {
privateNetwork = true;
# hostAddress = "192.168.100.10";
# localAddress = "192.168.100.11";
hostBridge = "br0"; # Specify the bridge name
localAddress = "192.168.1.171/24";
# hostBridge = "br0"; # Specify the bridge name
# localAddress = "192.168.1.171/24";
bindMounts = {
"/home/steam/.steam/steam/steamapps/common/SMITE" = {

1
modules/nixos/server/default.nix
View file

@ -6,5 +6,6 @@
./media.nix
./sync.nix
./wireguard.nix
];
}

10
modules/nixos/server/docker/default.nix
View file

@ -1,16 +1,16 @@
{ pkgs, lib, ... }: {
{ pkgs, lib, config, ... }: {
imports = [
./media.nix
];
options.mods.docker.media = {
options.mods.docker = {
enable = lib.mkEnableOption {
default = false;
description = "enables docker containers for media server";
description = "enables docker containers";
};
};
config = lib.mkIf config.mods.docker.media.enable {
config = lib.mkIf config.mods.docker.enable {
environment.systemPackages = [
pkgs.arion
@ -27,6 +27,6 @@
virtualisation.podman.defaultNetwork.dnsname.enable = true;
# Use your username instead of `myuser`
users.extraUsers.${mods.user.name}.extraGroups = ["podman"];
users.extraUsers.${config.mods.user.name}.extraGroups = ["podman"];
};
}

38
modules/nixos/server/docker/media.nix
View file

@ -7,24 +7,24 @@
};
config = lib.mkIf config.mods.docker.media.enable {
virtualisation.arion = {
backend = "docker";
projects = {
"hyperpipe".settings.services = {
"hyperpipe-frontend".service = {
image = "codeberg.org/hyperpipe/hyperpipe:latest";
container-name = "hyperpipe-frontend";
restart = "unless-stopped";
ports = ["8080:80"];
};
"hyperpipe-backend".service = {
image = "codeberg.org/hyperpipe/hyperpipe:latest";
container_name = "hyperpipe-backend";
restart = "unless-stopped";
ports = ["3000:3000"];
};
};
};
};
# virtualisation.arion = {
# backend = "docker";
# projects = {
# "hyperpipe".settings.services = {
# "hyperpipe-frontend".service = {
# image = "codeberg.org/hyperpipe/hyperpipe:latest";
# container-name = "hyperpipe-frontend";
# restart = "unless-stopped";
# ports = ["8080:80"];
# };
# "hyperpipe-backend".service = {
# image = "codeberg.org/hyperpipe/hyperpipe:latest";
# container_name = "hyperpipe-backend";
# restart = "unless-stopped";
# ports = ["3000:3000"];
# };
# };
# };
# };
};
}

45
modules/nixos/server/wireguard.nix Normal file
View file

@ -0,0 +1,45 @@
{ pkgs, lib, config, ... }: {
options.mods.server.wireguard = {
enable = lib.mkEnableOption {
default = false;
description = "enables wireguard server";
};
};
config = lib.mkIf config.mods.server.wireguard.enable {
networking.nat.enable = true;
networking.nat.externalInterface = "ens3";
networking.nat.internalInterfaces = [ "wg0" ];
networking.firewall = {
allowedUDPPorts = [ 51820 ];
};
networking.wireguard.interfaces = {
wg0 = {
ips = [ "10.100.0.1/24" ];
listenPort = 51820;
postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
'';
# This undoes the above command
postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
'';
privateKeyFile = "/home/muon/wireguard-keys/private";
peers = [
{
publicKey = "MDBdADwP/SE/T9cadXB1Mup7Dr3x+l6gBFBN83BU4Dg=";
allowedIPs = [ "10.100.0.2/32" ];
}
];
};
};
};
}