From 75485b38f43b33d87372e58d0bbd5fe32e93e2cb Mon Sep 17 00:00:00 2001
From: Gabriel Fontes <eu@misterio.me>
Date: Mon, 22 Nov 2021 07:26:09 -0300
Subject: [PATCH] add wireguard server and client

---
 hosts/merope/default.nix    |  9 +++++++--
 hosts/merope/wireguard.nix  | 40 +++++++++++++++++++++++++++++++++++++
 hosts/pleione/wireguard.nix | 23 +++++++++++++++++++++
 3 files changed, 70 insertions(+), 2 deletions(-)
 create mode 100644 hosts/merope/wireguard.nix
 create mode 100644 hosts/pleione/wireguard.nix

diff --git a/hosts/merope/default.nix b/hosts/merope/default.nix
index f3bfd5ff..3daf0fd7 100644
--- a/hosts/merope/default.nix
+++ b/hosts/merope/default.nix
@@ -11,11 +11,13 @@ in
     hardware.nixosModules.raspberry-pi-4
     impermanence.nixosModules.impermanence
     nur-no-pkgs.repos.misterio.modules.argonone
+    ../common.nix
+    ./hardware-configuration.nix
+
     ./acme.nix
     ./ddclient.nix
     ./projeto-bd.nix
-    ./hardware-configuration.nix
-    ../common.nix
+    ./wireguard.nix
   ];
 
   networking.hostName = "merope";
@@ -48,6 +50,9 @@ in
     }
   ];
 
+  # Enable wireguard ip forwarding
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
   security = {
     # Passwordless sudo (for remote build)
     sudo.extraConfig = ''
diff --git a/hosts/merope/wireguard.nix b/hosts/merope/wireguard.nix
new file mode 100644
index 00000000..8d0a21a1
--- /dev/null
+++ b/hosts/merope/wireguard.nix
@@ -0,0 +1,40 @@
+{ pkgs, ... }:
+let
+  iptables = "${pkgs.iptables}/bin/iptables";
+in
+{
+  networking = {
+    nat = {
+      enable = true;
+      externalInterface = "eth0";
+      internalInterfaces = [ "wg0" ];
+    };
+    firewall.allowedUDPPorts = [ 51820 ];
+    wireguard = {
+      enable = true;
+      interfaces = {
+        wg0 = {
+          ips = [ "10.100.0.1/24" ];
+          listenPort = 51820;
+          privateKeyFile = "/data/etc/wireguard/private.key";
+          postSetup = ''
+            ${iptables} -A FORWARD -i %i -j ACCEPT
+            ${iptables} -A FORWARD -o %i -j ACCEPT
+            ${iptables} -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+          '';
+          postShutdown = ''
+            ${iptables} -D FORWARD -i %i -j ACCEPT
+            ${iptables} -D FORWARD -o %i -j ACCEPT
+            ${iptables} -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+          '';
+          peers = [
+            {
+              publicKey = "OpU45rd0BrLPWHrtPtN8U5s4b3RU10B4TiHAN0p842g=";
+              allowedIPs = [ "10.100.0.2/32" ];
+            }
+          ];
+        };
+      };
+    };
+  };
+}
diff --git a/hosts/pleione/wireguard.nix b/hosts/pleione/wireguard.nix
new file mode 100644
index 00000000..1809a1b8
--- /dev/null
+++ b/hosts/pleione/wireguard.nix
@@ -0,0 +1,23 @@
+{ pkgs, ... }:
+{
+  networking = {
+    wireguard = {
+      enable = true;
+      interfaces = {
+        wg0 = {
+          ips = [ "10.100.0.3/24" ];
+          listenPort = 51820;
+          privateKeyFile = "/data/etc/wireguard/private.key";
+          peers = [
+            {
+              publicKey = "a3dmQRbDmCeWEUyiUxAIjoI5icfzw8llKv5BHTgCJw8=";
+              allowedIPs = [ "0.0.0.0/0" "::/0" ];
+              endpoint = "home.misterio.me:51820";
+              persistentKeepalive = 25;
+            }
+          ];
+        };
+      };
+    };
+  };
+}