karaolidis/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add haproxy/mmproxy combo

Browse Source 
Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>
This commit is contained in:
Nick Karaolidis
2025-03-01 23:02:03 +00:00
parent ae66cfd854
commit a271e892c3
7 changed files with 101 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
hosts/jupiter-vps/configs/wireguard/default.nix
View File

@@ -1,12 +1,6 @@
{
config,
inputs,
pkgs,
...
}:
{ config, inputs, ... }:
let
jupiterConfig = inputs.self.nixosConfigurations.jupiter.config;
publicInterface = "ens3";
wireguardPort = 51820;
in
{
@@ -20,40 +14,18 @@ in
allowedUDPPorts = [ wireguardPort ] ++ jupiterConfig.networking.firewall.allowedUDPPorts;
};
wireguard.interfaces.wg0 =
let
iptables = "${pkgs.iptables}/bin/iptables";
in
rec {
ips = [ "10.0.0.1/24" ];
listenPort = wireguardPort;
privateKeyFile = config.sops.secrets."wireguard".path;
wireguard.interfaces.wg0 = {
ips = [ "10.0.0.1/24" ];
listenPort = wireguardPort;
privateKeyFile = config.sops.secrets."wireguard".path;
postSetup = [
"${iptables} -t nat -A PREROUTING -i ${publicInterface} -p tcp --dport ${builtins.toString (builtins.elemAt config.services.openssh.ports 0)} -j RETURN"
"${iptables} -t nat -A PREROUTING -i ${publicInterface} -p udp --dport ${builtins.toString listenPort} -j RETURN"
"${iptables} -t nat -A PREROUTING -i ${publicInterface} -j DNAT --to-destination 10.0.0.2"
"${iptables} -t nat -A POSTROUTING -d 10.0.0.2 -p tcp --dport ${builtins.toString (builtins.elemAt config.services.openssh.ports 0)} -j RETURN"
"${iptables} -t nat -A POSTROUTING -d 10.0.0.2 -p udp --dport ${builtins.toString listenPort} -j RETURN"
"${iptables} -t nat -A POSTROUTING -d 10.0.0.2 -j SNAT --to-source 10.0.0.1"
];
postShutdown = [
"${iptables} -t nat -D PREROUTING -i ${publicInterface} -p tcp --dport ${builtins.toString (builtins.elemAt config.services.openssh.ports 0)} -j RETURN"
"${iptables} -t nat -D PREROUTING -i ${publicInterface} -p udp --dport ${builtins.toString listenPort} -j RETURN"
"${iptables} -t nat -D PREROUTING -i ${publicInterface} -j DNAT --to-destination 10.0.0.2"
"${iptables} -t nat -D POSTROUTING -d 10.0.0.2 -p tcp --dport ${builtins.toString (builtins.elemAt config.services.openssh.ports 0)} -j RETURN"
"${iptables} -t nat -D POSTROUTING -d 10.0.0.2 -p udp --dport ${builtins.toString listenPort} -j RETURN"
"${iptables} -t nat -D POSTROUTING -d 10.0.0.2 -j SNAT --to-source 10.0.0.1"
];
peers = [
{
name = "jupiter";
allowedIPs = [ "10.0.0.2/32" ];
publicKey = "Lvx7bpyqI8rUrxYVDolz7T+EPuRWDohJAAToq7kH7EU=";
}
];
};
peers = [
{
name = "jupiter";
allowedIPs = [ "10.0.0.2/32" ];
publicKey = "Lvx7bpyqI8rUrxYVDolz7T+EPuRWDohJAAToq7kH7EU=";
}
];
};
};
}