Jimbo VPN.

nixos/server.nix

@@ -33,9 +33,9 @@
     ./server/nginx.nix
     ./server/owncast.nix
     ./server/minecraft
-    ./server/tandoor.nix
     ./server/vaultwarden.nix
     ./server/transmission.nix
+    ./server/wireguard.nix
     ./server/misc.nix
 
     # Matrix

nixos/server/firewall.nix

@@ -43,6 +43,7 @@
             chain POSTROUTING {
               type nat hook postrouting priority 100; policy accept;
               oifname "${ips.netInt}" masquerade
+	      ip saddr 10.100.0.0/24 oifname "${ips.netInt}" masquerade comment "WireGuard"
             }
           '';
         };

nixos/server/tandoor.nix

@@ -1,16 +0,0 @@
-{outputs, ...}: {
-  services = {
-    tandoor-recipes = {
-      enable = true;
-      port = 5030;
-    };
-    nginx.virtualHosts."recipes.${outputs.secrets.jimDomain}" =  {
-      enableACME = true;
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:5030";
-        proxyWebsockets = true;
-      };
-    };
-  };
-}

nixos/server/wireguard.nix

@@ -0,0 +1,28 @@
+{outputs, ...}: let
+  ips = import ../modules/ips.nix;
+in {
+  # enable NAT
+  networking.nat.enable = true;
+  networking.nat.externalInterface = "${ips.netInt}";
+  networking.nat.internalInterfaces = [ "wg0" ];
+  networking.firewall.allowedUDPPorts = [ 51820 ];
+
+  networking.wireguard = {
+    enable = true;
+    interfaces = {
+      # Wireguard interface name can be arbitrary
+      wg0 = {
+        # Determines the IP address and subnet of the server's end of the tunnel interface.
+        ips = [ "10.100.0.1/24" ];
+        listenPort = 51820;
+	privateKey = outputs.secrets.wireguardPriv;
+        peers = [
+          { # Jimbo
+            publicKey = outputs.secrets.wirePhonePub;
+            allowedIPs = [ "10.100.0.2/32" ];
+          }
+        ];
+      };
+    };
+  };
+}