110 lines
2.6 KiB
Nix
110 lines
2.6 KiB
Nix
{ lib, values, ... }:
|
|
{
|
|
services.openvpn.servers."ov-tunnel" = {
|
|
config = let
|
|
conf = {
|
|
# TODO: use aliases
|
|
client = true;
|
|
dev = "tap";
|
|
proto = "udp";
|
|
#remote = "129.241.210.253 1194";
|
|
remote = "129.241.210.191 1194";
|
|
|
|
resolv-retry = "infinite";
|
|
nobind = true;
|
|
|
|
ca = "/etc/openvpn/ca.pem";
|
|
cert = "/etc/openvpn/crt.pem";
|
|
key = "/etc/openvpn/key.pem";
|
|
remote-cert-tls = "server";
|
|
cipher = "none";
|
|
|
|
user = "nobody";
|
|
group = "nobody";
|
|
|
|
status = "/var/log/openvpn-status.log";
|
|
|
|
persist-key = true;
|
|
persist-tun = true;
|
|
|
|
verb = 5;
|
|
|
|
# script-security = 2;
|
|
# up = "systemctl restart rwhod";
|
|
};
|
|
in lib.pipe conf [
|
|
(lib.filterAttrs (_: value: !(builtins.isNull value || value == false)))
|
|
(builtins.mapAttrs (_: value:
|
|
if builtins.isList value then builtins.concatStringsSep " " (map toString value)
|
|
else if value == true then value
|
|
else if builtins.any (f: f value) [
|
|
builtins.isString
|
|
builtins.isInt
|
|
builtins.isFloat
|
|
lib.isPath
|
|
lib.isDerivation
|
|
] then toString value
|
|
else throw "Unknown value in buskerud openvpn config, deading now\n${value}"
|
|
))
|
|
(lib.mapAttrsToList (name: value: if value == true then name else "${name} ${value}"))
|
|
(builtins.concatStringsSep "\n")
|
|
(x: x + "\n\n")
|
|
];
|
|
};
|
|
|
|
systemd.network.networks."enp14s0f1" = {
|
|
matchConfig.Name = "enp14s0f1";
|
|
networkConfig = {
|
|
DefaultRouteOnDevice = true;
|
|
};
|
|
routes = [
|
|
{ routeConfig = {
|
|
Type = "unicast";
|
|
Destination = values.hosts.knutsen.ipv4 + "/32";
|
|
Metric = 50;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
systemd.network.netdevs."br0" = {
|
|
netdevConfig = {
|
|
Kind = "bridge";
|
|
Name = "br0";
|
|
};
|
|
};
|
|
|
|
systemd.network.networks."br0" = {
|
|
matchConfig.Name = "br0";
|
|
routes = [
|
|
{ routeConfig = {
|
|
Type = "unicast";
|
|
Destination = values.ipv4-space;
|
|
Metric = 100;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
systemd.network.networks."enp3s0f0" = {
|
|
matchConfig.Name = "enp3s0f0";
|
|
networkConfig.DefaultRouteOnDevice = false;
|
|
};
|
|
|
|
systemd.network.networks."enp3s0f1" = {
|
|
matchConfig.Name = "enp3s0f1";
|
|
bridge = [ "br0" ];
|
|
};
|
|
|
|
systemd.network.networks."tap0" = {
|
|
matchConfig.Name = "tap0";
|
|
bridge = [ "br0" ];
|
|
};
|
|
|
|
#networking.nat = {
|
|
# enable = true;
|
|
# externalInterface = "enp14s0f1";
|
|
# internalInterfaces = [ "tun" ];
|
|
#};
|
|
}
|