add wireguard server and client

hosts/merope/default.nix

@@ -11,11 +11,13 @@ in
     hardware.nixosModules.raspberry-pi-4
     impermanence.nixosModules.impermanence
     nur-no-pkgs.repos.misterio.modules.argonone
+    ../common.nix
+    ./hardware-configuration.nix
+
     ./acme.nix
     ./ddclient.nix
     ./projeto-bd.nix
-    ./hardware-configuration.nix
-    ../common.nix
+    ./wireguard.nix
   ];
 
   networking.hostName = "merope";
@@ -48,6 +50,9 @@ in
     }
   ];
 
+  # Enable wireguard ip forwarding
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
   security = {
     # Passwordless sudo (for remote build)
     sudo.extraConfig = ''

hosts/merope/wireguard.nix

@@ -0,0 +1,40 @@
+{ pkgs, ... }:
+let
+  iptables = "${pkgs.iptables}/bin/iptables";
+in
+{
+  networking = {
+    nat = {
+      enable = true;
+      externalInterface = "eth0";
+      internalInterfaces = [ "wg0" ];
+    };
+    firewall.allowedUDPPorts = [ 51820 ];
+    wireguard = {
+      enable = true;
+      interfaces = {
+        wg0 = {
+          ips = [ "10.100.0.1/24" ];
+          listenPort = 51820;
+          privateKeyFile = "/data/etc/wireguard/private.key";
+          postSetup = ''
+            ${iptables} -A FORWARD -i %i -j ACCEPT
+            ${iptables} -A FORWARD -o %i -j ACCEPT
+            ${iptables} -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+          '';
+          postShutdown = ''
+            ${iptables} -D FORWARD -i %i -j ACCEPT
+            ${iptables} -D FORWARD -o %i -j ACCEPT
+            ${iptables} -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+          '';
+          peers = [
+            {
+              publicKey = "OpU45rd0BrLPWHrtPtN8U5s4b3RU10B4TiHAN0p842g=";
+              allowedIPs = [ "10.100.0.2/32" ];
+            }
+          ];
+        };
+      };
+    };
+  };
+}

hosts/pleione/wireguard.nix

@@ -0,0 +1,23 @@
+{ pkgs, ... }:
+{
+  networking = {
+    wireguard = {
+      enable = true;
+      interfaces = {
+        wg0 = {
+          ips = [ "10.100.0.3/24" ];
+          listenPort = 51820;
+          privateKeyFile = "/data/etc/wireguard/private.key";
+          peers = [
+            {
+              publicKey = "a3dmQRbDmCeWEUyiUxAIjoI5icfzw8llKv5BHTgCJw8=";
+              allowedIPs = [ "0.0.0.0/0" "::/0" ];
+              endpoint = "home.misterio.me:51820";
+              persistentKeepalive = 25;
+            }
+          ];
+        };
+      };
+    };
+  };
+}