diff options
author | Kjetil Orbekk <kj@orbekk.com> | 2021-08-04 17:41:54 -0400 |
---|---|---|
committer | Kjetil Orbekk <kj@orbekk.com> | 2021-08-04 17:41:54 -0400 |
commit | 23fdf2674740d188c6e67a2a65be725bbebf8a33 (patch) | |
tree | 1ef86ffdcd1f7854a2088912ad4d542460829191 /modules/mullvad.nix | |
parent | 3dd845d83436534841de8c3aa9a48d88d5d487e8 (diff) |
fix config
Diffstat (limited to 'modules/mullvad.nix')
-rw-r--r-- | modules/mullvad.nix | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/modules/mullvad.nix b/modules/mullvad.nix new file mode 100644 index 0000000..436a3b2 --- /dev/null +++ b/modules/mullvad.nix @@ -0,0 +1,39 @@ +{ config, lib, pkgs, ... }: + +let + cfg = config.orbekk.mullvad; +in +{ + options = { + orbekk.mullvad = { + enable = lib.mkEnableOption "Enable VPN"; + + listenPort = lib.mkOption { + type = lib.types.port; + default = 40421; + description = "wireguard local port"; + }; + }; + }; + + config = lib.mkIf cfg.enable { + orbekk.simple-firewall.allowedUDPPorts = [ cfg.listenPort ]; + + networking.wireguard = { + enable = true; + interfaces.mullvad = { + privateKeyFile = "/opt/secret/wireguard/mullvad.private"; + ips = [ "10.70.90.245/32" "fc00:bbbb:bbbb:bb01::7:5af4/128" ]; + allowedIPsAsRoutes = false; + listenPort = cfg.listenPort; + peers = [ + { + endpoint = "ca10-wireguard.mullvad.net:51820"; + publicKey = "pAVh6WJtyF7ktvavez399L4A615TXOAaUHQgpwJ4EHU="; + allowedIPs = [ "0.0.0.0/0" "::0/0" ]; + } + ]; + }; + }; + }; +} |