nixos

commit d6298cd994866bfc6f57085d6726ed92ba55a28d
parent e42fbe7091ad1215b64a8e0c4a46e91d60acd532
Author: MTRNord <mtrnord1@gmail.com>
Date:   Wed,  4 Oct 2023 12:56:05 +0200

Full mesh

Diffstat:
M
nixos/worker-1/configuration.nix
 | 
55
+++++++++++++++++++++++++++++++++++++++++++------------
M
nixos/worker-2/configuration.nix
 | 
54
++++++++++++++++++++++++++++++++++++++++++------------

2 files changed, 85 insertions(+), 24 deletions(-)
diff --git a/nixos/worker-1/configuration.nix b/nixos/worker-1/configuration.nix
@@ -178,20 +178,50 @@
             allowedIPs = [
               "10.100.12.1/24"
               "10.100.0.2/24"
+              "10.100.0.202/24"
               "fe99:13::2/64"
+              "fe99:13::202/64"
+              "10.100.0.1/24"
+              "10.100.0.201/24"
+              "fe99:13::1/64"
+              "fe99:13::201/64"
+              "10.100.0.3/24"
+              "10.100.0.203/24"
+              "fe99:13::3/64"
+              "fe99:13::203/64"
             ];
             persistentKeepalive = 25;
-            endpoint = "95.217.202.35:51820";
+            endpoint = "95.217.202.35:51821";
+          }
+        ];
+      };
+      wg0 = {
+        address = [ "10.100.0.201/24" "fe99:13::201/64" ];
+        listenPort = 51821;
+        privateKeyFile = config.sops.secrets."wireguard/private_key".path;
+        table = "off";
+
+        peers = [
+          # worker-2
+          {
+            publicKey = "gswnnC4NQp0fXXGDhLaPVslCYPHMsXti0JloOzuGdn8=";
+            allowedIPs = [
+              "10.100.12.1/24"
+              "10.100.0.2/24"
+              "10.100.0.202/24"
+              "fe99:13::2/64"
+              "fe99:13::202/64"
+              "10.100.0.1/24"
+              "10.100.0.201/24"
+              "fe99:13::1/64"
+              "fe99:13::201/64"
+              "10.100.0.3/24"
+              "10.100.0.203/24"
+              "fe99:13::3/64"
+              "fe99:13::203/64"
+            ];
+            endpoint = "37.27.5.79:51821";
           }
-          # # worker-2
-          # {
-          #   publicKey = "gswnnC4NQp0fXXGDhLaPVslCYPHMsXti0JloOzuGdn8=";
-          #   allowedIPs = [
-          #     "10.100.0.3/24"
-          #     "fe99:13::3/64"
-          #   ];
-          #   endpoint = "37.27.5.79:51820";
-          # }
         ];
       };
 
@@ -257,6 +287,7 @@
           80
           443
           51820
+          51821
           9962
           9100
         ];
@@ -462,7 +493,7 @@
           };
           graceful restart 1;
           area 0 {
-            interface "wg0";
+            interface "wg0", "wg1";
           };
         }
 
@@ -473,7 +504,7 @@
           };
           graceful restart 1;
           area 0 {
-            interface "wg0";
+            interface "wg0", "wg1";
           };
         }
       '';
diff --git a/nixos/worker-2/configuration.nix b/nixos/worker-2/configuration.nix
@@ -151,21 +151,50 @@
             allowedIPs = [
               "10.100.12.1/24"
               "10.100.0.2/24"
+              "10.100.0.202/24"
               "fe99:13::2/64"
+              "fe99:13::202/64"
+              "10.100.0.1/24"
+              "10.100.0.201/24"
+              "fe99:13::1/64"
+              "fe99:13::201/64"
+              "10.100.0.3/24"
+              "10.100.0.203/24"
+              "fe99:13::3/64"
+              "fe99:13::203/64"
             ];
             persistentKeepalive = 25;
             endpoint = "95.217.202.35:51820";
           }
-          # # worker-1
-          # {
-          #   publicKey = "IGlPQDCrkWDPgzxSADbed/UFLxz93K+rRXXu9aa4+G8=";
-          #   allowedIPs = [
-          #     "10.100.12.1/24"
-          #     "10.100.0.1/24"
-          #     "fe99:13::1/64"
-          #   ];
-          #   endpoint = "49.13.24.105:51820";
-          # }
+        ];
+      };
+      wg1 = {
+        address = [ "10.100.0.203/24" "fe99:13::203/64" ];
+        listenPort = 51821;
+        privateKeyFile = config.sops.secrets."wireguard/worker-2/private_key".path;
+        table = "off";
+
+        peers = [
+          # worker-1
+          {
+            publicKey = "IGlPQDCrkWDPgzxSADbed/UFLxz93K+rRXXu9aa4+G8=";
+            allowedIPs = [
+              "10.100.12.1/24"
+              "10.100.0.2/24"
+              "10.100.0.202/24"
+              "fe99:13::2/64"
+              "fe99:13::202/64"
+              "10.100.0.1/24"
+              "10.100.0.201/24"
+              "fe99:13::1/64"
+              "fe99:13::201/64"
+              "10.100.0.3/24"
+              "10.100.0.203/24"
+              "fe99:13::3/64"
+              "fe99:13::203/64"
+            ];
+            endpoint = "49.13.24.105:51821";
+          }
         ];
       };
 
@@ -227,6 +256,7 @@
         allowedTCPPorts = [
           22 # ssh
           51820
+          51821
           9962
           9100
         ];
@@ -354,7 +384,7 @@
           };
           graceful restart 1;
           area 0 {
-            interface "wg0";
+            interface "wg0", "wg1";
           };
         }
 
@@ -365,7 +395,7 @@
           };
           graceful restart 1;
           area 0 {
-            interface "wg0";
+            interface "wg0", "wg1";
           };
         }
       '';