Lander Van den Bulcke
42ed02f151
Signed-off-by: Lander Van den Bulcke <landervandenbulcke@gmail.com>
64 lines
1.2 KiB
Nix
64 lines
1.2 KiB
Nix
{ config, ... }:
|
|
{
|
|
imports = [
|
|
./disk-config.nix
|
|
{
|
|
_module.args.disks = [ "/dev/sda" ];
|
|
}
|
|
|
|
../common/servers
|
|
];
|
|
|
|
time.timeZone = "Europe/Berlin";
|
|
|
|
networking.hostName = "hosting-02";
|
|
networking.firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [
|
|
80
|
|
443
|
|
];
|
|
};
|
|
|
|
systemd.network.networks."30-wan".address = [
|
|
"2a01:4f8:c013:7fc0::/64"
|
|
];
|
|
|
|
networking.wireguard = {
|
|
enable = true;
|
|
|
|
interfaces.wg0 = {
|
|
ips = [
|
|
"10.64.244.95/32"
|
|
"fc00:bbbb:bbbb:bb01::1:f45e/128"
|
|
];
|
|
|
|
peers = [
|
|
{
|
|
publicKey = "KkShcqgwbkX2A9n1hhST6qu+m3ldxdJ2Lx8Eiw6mdXw=";
|
|
allowedIPs = [
|
|
"0.0.0.0/0"
|
|
"::0/0"
|
|
];
|
|
endpoint = "146.70.117.226:51820";
|
|
persistentKeepalive = 25;
|
|
}
|
|
];
|
|
|
|
listenPort = 51820;
|
|
privateKeyFile = config.sops.secrets.wireguardKey.path;
|
|
};
|
|
};
|
|
|
|
sops.secrets = {
|
|
wireguardKey = {
|
|
owner = "root";
|
|
sopsFile = ./secrets.yaml;
|
|
};
|
|
};
|
|
|
|
security.acme.defaults.email = "landervandenbulcke@gmail.com";
|
|
security.acme.acceptTerms = true;
|
|
|
|
system.stateVersion = "25.05";
|
|
}
|