add a profile for wireguard configuration

4 files changed, 68 insertions, 2 deletions

diff --git a/profiles/hardware/do-droplet.nix b/profiles/hardware/do-droplet.nix
index aef5805..28d025a 100644
--- a/profiles/hardware/do-droplet.nix
+++ b/profiles/hardware/do-droplet.nix
@@ -1,10 +1,13 @@
 { modulesPath, lib, ... }:
 {
-
   imports = [
     (modulesPath + "/virtualisation/digital-ocean-config.nix")
   ];
 
+  # fixes duplicated devices in mirroredBoots
+  boot.loader.grub.devices = lib.mkForce [ "/dev/vda" ];
+  disko.devices.disk.disk1.device = "/dev/vda";
+
   # do not use DHCP, as DigitalOcean provisions IPs using cloud-init
   networking.useDHCP = lib.mkForce false;
 
diff --git a/profiles/hardware/framework-desktop.nix b/profiles/hardware/framework-desktop.nix
index 85580d1..b1019b8 100644
--- a/profiles/hardware/framework-desktop.nix
+++ b/profiles/hardware/framework-desktop.nix
@@ -1,4 +1,4 @@
-{ inputs, ... }:
+{ lib, inputs, ... }:
 {
   imports = [
     inputs.nixos-hardware.nixosModules.framework-desktop-amd-ai-max-300-series
@@ -27,4 +27,6 @@
 
   hardware.enableRedistributableFirmware = true;
   hardware.cpu.amd.updateMicrocode = true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }
diff --git a/profiles/hardware/synology-vm.nix b/profiles/hardware/synology-vm.nix
index 7d784eb..053cf41 100644
--- a/profiles/hardware/synology-vm.nix
+++ b/profiles/hardware/synology-vm.nix
@@ -4,6 +4,9 @@
     (modulesPath + "/profiles/qemu-guest.nix")
   ];
 
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.loader.systemd-boot.enable = true;
+
   boot.initrd.availableKernelModules = [
     "ata_piix"
     "uhci_hcd"
diff --git a/profiles/wireguard.nix b/profiles/wireguard.nix
new file mode 100644
index 0000000..a080693
--- /dev/null
+++ b/profiles/wireguard.nix
@@ -0,0 +1,58 @@
+{ config, lib, ... }:
+
+let
+  wgHosts = {
+    bree = {
+      ip = 40;
+      publicKey = "bJZyQoemudGJQox8Iegebm23c4BNVIxRPy1kmI2l904=";
+      endpoint = "192.168.1.50";
+    };
+    argonath = {
+      ip = 51;
+      publicKey = "vTItDh9YPnA+8hL1kIK+7EHv0ol3qvhfAfz790miw1w=";
+      endpoint = "157.230.146.234";
+    };
+    rivendell = {
+      ip = 60;
+      publicKey = "jf7T7TMKQWSgSXhUplldZDV9G2y2BjMmHIAhg5d26ng=";
+      endpoint = "192.168.1.114";
+    };
+  };
+
+  wgPort = 51820;
+  wgSubnet = "10.100.0";
+
+  currentHostname = config.networking.hostName;
+  currentHost =
+    wgHosts.${currentHostname}
+      or (throw "Host ${currentHostname} not found in wireguard configuration");
+
+  peers = lib.mapAttrsToList (
+    _hostname: hostCfg:
+    {
+      publicKey = hostCfg.publicKey;
+      allowedIPs = [ "${wgSubnet}.${toString hostCfg.ip}/32" ];
+      persistentKeepalive = 25;
+    }
+    // lib.optionalAttrs (hostCfg.endpoint != null) {
+      endpoint = "${hostCfg.endpoint}:${toString wgPort}";
+    }
+  ) (lib.filterAttrs (n: _v: n != currentHostname) wgHosts);
+
+in
+{
+  age.secrets.wireguard.file = ../secrets/${currentHostname}/wireguard.age;
+
+  networking.wireguard = {
+    enable = true;
+    interfaces.wg0 = {
+      ips = [ "${wgSubnet}.${toString currentHost.ip}/32" ];
+      listenPort = wgPort;
+      privateKeyFile = config.age.secrets.wireguard.path;
+      inherit peers;
+    };
+  };
+
+  networking.firewall.trustedInterfaces = [ "wg0" ];
+  networking.firewall.allowedUDPPorts = [ wgPort ];
+}