44 lines
1.1 KiB
Nix
44 lines
1.1 KiB
Nix
{ config, lib, ... }:
|
|
let
|
|
cfg = config.custom.networking.netflixWg;
|
|
host = config.networking.hostName;
|
|
in
|
|
{
|
|
options.custom.networking = {
|
|
netflixWg = {
|
|
enable = lib.mkEnableOption "Netflix WireGuard";
|
|
suffix = lib.mkOption {
|
|
type = with lib.types; nullOr (strMatching "^[0-9.]+$");
|
|
default = null;
|
|
description = "IPv4 Suffix for Netflix WireGuard config";
|
|
};
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
sops.secrets.priv-netflix-wg.sopsFile = ../../secrets/${host}/netflix-wg.yaml;
|
|
|
|
networking = {
|
|
wg-quick.interfaces = {
|
|
wg1 = {
|
|
autostart = false;
|
|
address = [ "10.100.0.${cfg.suffix}/24" ];
|
|
dns = [ "1.1.1.1" ];
|
|
privateKeyFile = config.sops.secrets.priv-netflix-wg.path;
|
|
listenPort = 51820;
|
|
|
|
peers = [
|
|
{
|
|
publicKey = "XSYHg0utIR1j7kRsWFwuWNo4RPD47KP53cVa6qDPtRE=";
|
|
allowedIPs = [
|
|
"0.0.0.0/0"
|
|
"192.168.0.0/24"
|
|
];
|
|
endpoint = "netflix.vsinerva.fi:51821";
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|