This repository has no description
1.8 kB
78 lines
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7{
8 environment.systemPackages = [
9 pkgs.cunicu
10 ];
11
12 networking.firewall.allowedUDPPorts = [ 42230 ];
13
14 environment.etc."cunicu.yaml".text = builtins.toJSON {
15 # backends = [
16 # "grpc://signal.cunicu.li:443"
17 # ];
18 rpc.socket = "/var/run/cunicu.sock";
19
20 listen_port = 51820;
21
22 sync_routes = true;
23 sync_hosts = true;
24
25 domain = "c";
26
27 discover_peers = true;
28 discover_endpoints = true;
29 community = "aidsballs";
30
31 networks = [
32 "10.245.0.0/16"
33 ];
34
35 ice = {
36 urls = [
37 "stun:stun3.l.google.com:19302"
38 "stun:relay.webwormhole.io"
39 "stun:stun.sipgate.net"
40 "stun:stun.ekiga.net"
41 "stun:stun.services.mozilla.com"
42 ];
43 interface_filter = "w*|e*|v*|i*";
44 };
45
46 interfaces.wiregrill = { };
47
48 peers = lib.mapAttrs (
49 _: host:
50 {
51 public_key = host.nets.wiregrill.wireguard.pubkey;
52 allowed_ips =
53 with host.nets.wiregrill;
54 [
55 "${ip6.addr}/128"
56 ]
57 ++ (lib.optional (ip4 != null) "${ip4.addr}/32");
58 }
59 // lib.optionalAttrs (host.nets.wiregrill.via != null) {
60 endpoint = host.nets.wiregrill.via.ip4.addr + ":${toString host.nets.wiregrill.wireguard.port}";
61 }
62 ) (lib.filterAttrs (_: host: lib.hasAttr "wiregrill" host.nets) config.krebs.hosts);
63 };
64
65 systemd.services.cunicu = {
66 wantedBy = [ "multi-user.target" ];
67 restartTriggers = [ config.environment.etc."cunicu.yaml".source ];
68 environment = {
69 CUNICU_CONFIG_ALLOW_INSECURE = "true";
70 CUNICU_EXPERIMENTAL = "true";
71 };
72 serviceConfig = {
73 ExecStart = pkgs.writers.writeDash "cunicu" ''
74 ${pkgs.cunicu}/bin/cunicu daemon
75 '';
76 };
77 };
78}