add wg gateway config for nas

flake.lock

@@ -27,11 +27,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772845525,
+        "lastModified": 1774875815,
-        "narHash": "sha256-Dp5Ir2u4jJDGCgeMRviHvEQDe+U37hMxp6RSNOoMMPc=",
+        "narHash": "sha256-PzqwM4njoB3aznqwPZUawD4uOcJeu7N6GBTJKg81EQ4=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "27b93804fbef1544cb07718d3f0a451f4c4cd6c0",
+        "rev": "9340f51314713c83360bf72d75c8b404778ab5b1",
         "type": "github"
       },
       "original": {
@@ -57,11 +57,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1772773019,
+        "lastModified": 1774709303,
-        "narHash": "sha256-E1bxHxNKfDoQUuvriG71+f+s/NT0qWkImXsYZNFFfCs=",
+        "narHash": "sha256-D3Q07BbIA2KnTcSXIqqu9P586uWxN74zNoCH3h2ESHg=",
         "owner": "NixOs",
         "repo": "nixpkgs",
-        "rev": "aca4d95fce4914b3892661bcb80b8087293536c6",
+        "rev": "8110df5ad7abf5d4c0f6fb0f8f978390e77f9685",
         "type": "github"
       },
       "original": {

flake.nix

@@ -54,6 +54,8 @@
           ./software/default-graphical.nix
           ./users/shatteredmint.nix
           ./network-shares.nix
+
+          (import ./software/wireguard-client.nix {ip = 10;})
         ];
       };
       nix-nas = lib.nixosSystem {
@@ -69,6 +71,7 @@
           ./users/shatteredmint.nix
           ./software/samba.nix
           ./software/docker.nix
+          ./software/wireguard-gw-site.nix
         ];
       };
     };

software/wireguard-client.nix

@@ -0,0 +1,29 @@
+# reference: https://www.procustodibus.com/blog/2022/06/multi-hop-wireguard/#site-gateway-as-a-spoke
+# this configuration is for a device on the home network
+# it exposes the entire home network to outside peers
+
+{ip}: {
+    networking = {
+        firewall.allowedUDPPorts = [56878];
+        wireguard = {
+            enable = true;
+            interfaces.wg0 = {
+                ips = [ ("192.168.87." + builtins.toString(ip) + "/32")];
+                listenPort = 56878;
+                privateKeyFile = "/root/wg.keys";
+
+                peers = [
+                    {
+                        name = "hub";
+                        publicKey = "XEaJXQW+7llbreoK161NkMhFxlctL1UK8nFiY/GtuC0=";
+                        allowedIPs = [ "192.168.178.0/24" "192.168.87.127/32" "192.168.87.128/25"];
+                        endpoint = "173.249.36.74:56878";
+                        persistentKeepalive = 20;
+                    }
+                ];
+            };
+        };
+    };
+}
+
+

software/wireguard-gw-site.nix

@@ -0,0 +1,38 @@
+# reference: https://www.procustodibus.com/blog/2022/06/multi-hop-wireguard/#site-gateway-as-a-spoke
+# this configuration is for a device on the home network
+# it exposes the entire home network to outside peers
+
+{config, pkgs, ...}@inputs: {
+    networking = {
+        firewall.allowedUDPPorts = [56878];
+        wireguard = {
+            enable = true;
+            interfaces.wg0 = {
+                ips = [ "192.168.87.250/32"];
+                listenPort = 56878;
+                privateKeyFile = "/root/wg.keys";
+
+                peers = [
+                    {
+                        name = "hub";
+                        publicKey = "XEaJXQW+7llbreoK161NkMhFxlctL1UK8nFiY/GtuC0=";
+                        allowedIPs = [ "192.168.87.0/25"];
+                        endpoint = "173.249.36.74:56878";
+                        persistentKeepalive = 20;
+                    }
+                ];
+
+                postSetup = ''
+                    ${pkgs.iptables}/bin/iptables -t mangle -A PREROUTING -i wg0 -j MARK --set-mark 0x30
+                    ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING ! -o wg0 -m mark --mark 0x30 -j MASQUERADE
+                '';
+                postShutdown = ''
+                    ${pkgs.iptables}/bin/iptables -t mangle -D PREROUTING -i wg0 -j MARK --set-mark 0x30
+                    ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING ! -o wg0 -m mark --mark 0x30 -j MASQUERADE
+                '';
+            };
+        };
+    };
+}
+
+