foodogsquared/nixos-config
1
0
Fork 0
mirror of https://github.com/foo-dogsquared/nixos-config.git synced 2025-01-31 04:58:01 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

hosts/plover: remove OpenVPN module

Browse Source 
The Wireguard setup is working quite nicely compared to the OpenVPN
thingy. It is not as much integrated as OpenVPN though.
This commit is contained in:
Gabriel Arazas 2023-02-06 16:05:06 +08:00
parent 0086448efa
commit 213ecb8598
No known key found for this signature in database
GPG Key ID: ADE0C41DAB221FCC
1 changed files with 0 additions and 109 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

109
hosts/plover/modules/services/openvpn.nix
View File

@ -1,109 +0,0 @@
{ config, lib, pkgs, ... }:
let
certs = config.security.acme.certs;
networks = import ../hardware/networks.nix;
inherit (networks) publicIP publicIPv6 privateNetworkGatewayIP;
vpnAddressPoolStart = "172.43.1.1";
vpnAddressPoolEnd = "172.43.1.255";
acmeName = "openvpn.foodogsquared.one";
in
{
# We need a bridge to access locally hosted services in the network of the
# deployed server.
services.openvpn.servers = {
server = {
config =
let
certDirectory = certs."${acmeName}".directory;
dhParams = config.security.dhparams.params;
in
''
ca ${certDirectory}/chain.pem
cert ${certDirectory}/fullchain.pem
key ${certDirectory}/key.pem
dh ${dhParams."openvpn-server".path}
proto udp
topology subnet
server-bridge 172.43.0.1 255.255.255.0 ${vpnAddressPoolStart} ${vpnAddressPoolEnd}
server-ipv6 fd00::/8
dev vpn-tap
dev-type tap
# Connecting clients will be able to reach to one another.
client-to-client
user nobody
group nobody
'';
};
};
# We're generating our own certificates for OpenVPN. Most of the
# configuration should be taken care of with the defaults from the host
# config.
security.acme.certs."${acmeName}" = { };
# For key generation, debugging, panic configuration, anything else.
environment.systemPackages = [ pkgs.openvpn ];
systemd.network =
let
vpnBridgeIFName = "vpn-bridge";
vpnTapIFName = "vpn-tap";
in
{
netdevs = {
"90-${vpnBridgeIFName}".netdevConfig = {
Name = vpnBridgeIFName;
Kind = "bridge";
};
"90-${vpnTapIFName}" = {
netdevConfig = {
Name = vpnTapIFName;
Kind = "tap";
};
tapConfig = {
MultiQueue = true;
PacketInfo = true;
};
};
};
networks = {
"50-vpn-bridge-slave-1" = {
matchConfig.MACAddress = "86:00:00:32:48:20";
networkConfig.Bridge = vpnBridgeIFName;
};
"50-vpn-bridge-slave-tap" = {
matchConfig.Name = vpnTapIFName;
networkConfig.Bridge = vpnBridgeIFName;
};
"50-vpn-bridge-static" = {
matchConfig.Name = vpnBridgeIFName;
address = [
# The private network IP.
"172.43.0.1/32"
# Generate a new unique local IPv6 address.
"::"
];
gateway = [ privateNetworkGatewayIP ];
};
};
};
security.dhparams.params.openvpn-server = { };
}