EXPERIMENT: wireguard config

2026-04-02 09:49:57 +02:00
parent 57d07bae2c
commit 86b927b894
3 changed files with 69 additions and 0 deletions
@@ -0,0 +1,29 @@
+# reference: https://www.procustodibus.com/blog/2022/06/multi-hop-wireguard/#site-gateway-as-a-spoke
+# this configuration is for a device on the home network
+# it exposes the entire home network to outside peers
+
+{ip, config, pkgs, ...}@inputs: {
+    networking = {
+        firewall.allowedUDPPorts = [56878];
+        wireguard = {
+            enable = true;
+            interfaces.wg0 = {
+                ips = [ ("192.168.87." ++ ip ++ "/32")];
+                listenPort = 56878;
+                privateKeyFile = "/root/wg.keys";
+
+                peers = [
+                    {
+                        name = "hub";
+                        publicKey = "XEaJXQW+7llbreoK161NkMhFxlctL1UK8nFiY/GtuC0=";
+                        allowedIPs = [ "192.168.178.0/24" "192.168.87.127/32" "192.168.87.128/25"];
+                        endpoint = "173.249.36.74:56878";
+                        persistentKeepalive = 20;
+                    }
+                ];
+            };
+        };
+    };
+}
+
+