wireguard

modules/wireguard.nix

@@ -0,0 +1,60 @@
+{ pkgs, lib, config, ... }:
+{
+  options.wireguard = {
+    enable = lib.mkEnableOption "wireguard";
+    port = lib.mkOption {
+      default = 51820;
+      description = "The port for wireguard to use.";
+      type = lib.types.int;
+    };
+    externalInterface = lib.mkOption {
+      description = "The external networking interface for wireguard to use.";
+      type = lib.types.str;
+    };
+    internalInterface = lib.mkOption {
+      default = "wg0";
+      description = "The networking interface for wireguard to use.";
+      type = lib.types.str;
+    };
+    privateKeyFile = lib.mkOption {
+      description = "The path to the private key of the wireguard server.";
+      type = lib.types.path;
+    };
+  };
+
+  config = lib.mkIf config.wireguard.enable {
+    networking.nat.enable = true;
+    networking.nat.externalInterface = config.wireguard.externalInterface;
+    networking.nat.internalInterfaces = [ config.wireguard.internalInterface ];
+    networking.firewall.allowedUDPPorts = [ config.wireguard.port ];
+    networking.wireguard.interfaces = {
+      ${config.wireguard.internalInterface} = {
+        # Determines the IP address and subnet of the server's end of the tunnel interface.
+        ips = [ "10.100.0.1/24" ];
+        listenPort = config.wireguard.port;
+
+        # This allows the wireguard server to route your traffic to the internet and hence be like a VPN
+        # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
+        postSetup = ''
+          ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+          '';
+
+        # This undoes the above command
+        postShutdown = ''
+          ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+          '';
+
+        # Path to the servers private key file.
+        privateKeyFile = config.wireguard.privateKeyFile;
+
+        # TODO: add config option?
+        peers = [
+          {
+            publicKey = "L+NlTn0E9pgCoEoTYs4aDewZSMmyeyC1Os9DCdwYTjY=";
+            allowedIPs = [ "10.100.0.2/32" ];
+          }
+        ];
+      };
+    };
+  };
+}