c3d2/nix-config
c3d2
/
nix-config
24
7
Fork 3
Code Issues 12 Pull Requests 2 Releases Wiki Activity

freifunk: add vpn6 ipip tunnel

This commit is contained in:
Astro 2022-03-22 22:27:47 +01:00
parent 9eaeced6f1
commit 34dcd945d6
1 changed files with 35 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
hosts/containers/freifunk/default.nix
View File

@ -18,6 +18,8 @@ let
upstreams = [ "upstream4" "upstream3" "upstream1" ]; upstreams = [ "upstream4" "upstream3" "upstream1" ];
upstreamMark = 3; upstreamMark = 3;
rt_table_upstream = 100; rt_table_upstream = 100;
vpn6AddrPart = "200.16";
in { in {
imports = [ imports = [
"${modulesPath}/profiles/minimal.nix" "${modulesPath}/profiles/minimal.nix"
@ -84,7 +86,7 @@ in {
systemd.network = { systemd.network = {
netdevs = { netdevs = {
# Dummy interface for primary (10.200) address # Dummy interface for primary (10.200) address
bmx_prime = { bmx-prime = {
enable = true; enable = true;
netdevConfig = { netdevConfig = {
Kind = "bridge"; Kind = "bridge";
@ -92,10 +94,10 @@ in {
}; };
}; };
# Freifunk Dresden Backbone # Freifunk Dresden Backbone
vpn6 = { wg-vpn6 = {
enable = true; enable = true;
netdevConfig = { netdevConfig = {
Name = "vpn6"; Name = "wg-vpn6";
Kind = "wireguard"; Kind = "wireguard";
}; };
wireguardConfig = { wireguardConfig = {
@ -108,10 +110,21 @@ in {
wireguardPeerConfig = { wireguardPeerConfig = {
Endpoint = "vpn4.freifunk-dresden.de:5007"; Endpoint = "vpn4.freifunk-dresden.de:5007";
PublicKey = "7R3K3rGtCZprgqz5/iWql4yLg9BrsaNiv5XQwJ7csn4="; PublicKey = "7R3K3rGtCZprgqz5/iWql4yLg9BrsaNiv5XQwJ7csn4=";
AllowedIPs = "0.0.0.0/0"; AllowedIPs = "10.203.${vpn6AddrPart}/32";
}; };
} ]; } ];
}; };
ipip-vpn6 = {
enable = true;
netdevConfig = {
Name = "ipip-vpn6";
Kind = "ipip";
};
tunnelConfig = {
Local = "10.203.${ddmeshAddrPart}";
Remote = "10.203.${vpn6AddrPart}";
};
};
}; };
networks = { networks = {
# Wired mesh interface # Wired mesh interface
@ -119,10 +132,7 @@ in {
enable = true; enable = true;
matchConfig = { Name = meshInterface; }; matchConfig = { Name = meshInterface; };
addresses = [{ addresses = [{
addressConfig = { addressConfig.Address = "10.201.${ddmeshAddrPart}/16";
Address = "10.201.${ddmeshAddrPart}/16";
Broadcast = "10.255.255.255";
};
}]; }];
}; };
# Dummy interface for primary (10.200) address # Dummy interface for primary (10.200) address
@ -130,20 +140,24 @@ in {
enable = true; enable = true;
matchConfig = { Name = meshLoopback; }; matchConfig = { Name = meshLoopback; };
addresses = [{ addresses = [{
addressConfig = { addressConfig.Address = "10.200.${ddmeshAddrPart}/32";
Address = "10.200.${ddmeshAddrPart}/32";
Broadcast = "10.255.255.255";
};
}]; }];
}; };
"12-vpn6" = { "31-wg-vpn6" = {
enable = true; enable = true;
matchConfig.Name = "vpn6"; matchConfig.Name = "wg-vpn6";
addresses = [{ addresses = [{
addressConfig = { addressConfig.Address = "10.203.${ddmeshAddrPart}/32";
Address = "10.203.${ddmeshAddrPart}/16"; }];
Broadcast = "10.203.255.255"; routes = [ {
}; routeConfig.Destination = "10.203.${vpn6AddrPart}/32";
} ];
};
"32-ipip-vpn6" = {
enable = true;
matchConfig.Name = "ipip-vpn6";
addresses = [{
addressConfig.Address = "10.201.${ddmeshAddrPart}/16";
}]; }];
}; };
# ZW # ZW
@ -183,8 +197,9 @@ in {
--purge_timeout 20 \ --purge_timeout 20 \
--one_way_tunnel 1 \ --one_way_tunnel 1 \
-r 3 --gateway_hysteresis 20 \ -r 3 --gateway_hysteresis 20 \
dev=bmx_prime /linklayer 0 \ dev=${meshLoopback} /linklayer 0 \
dev=${meshInterface} /linklayer 1 dev=${meshInterface} /linklayer 1 \
dev=ipip-vpn6 /linklayer 1
''; '';
Restart = "always"; Restart = "always";
}; };