Set up Wireguard

Squashed commit of the following:

commit db95d142d4
Author: coolneng <akasroua@gmail.com>
Date:   Thu Jan 30 13:23:23 2020 +0100

    Update Syncthing IDs and add roamer to Wireguard

commit 6a2346d4a1
Author: coolneng <akasroua@gmail.com>
Date:   Wed Jan 29 14:30:31 2020 +0100

    Add wireguard server configuration

commit 09c5755ec8
Author: coolneng <akasroua@gmail.com>
Date:   Wed Jan 29 00:20:52 2020 +0100

    Add wireguard packages

commit c542b06c9d
Author: coolneng <akasroua@gmail.com>
Date:   Tue Jan 28 21:57:53 2020 +0100

    Move zeroconf section to networking

commit 1af6e07072
Author: coolneng <akasroua@gmail.com>
Date:   Tue Jan 28 21:54:39 2020 +0100

    Revert "Clean up packages and refactor nginx config"

    This reverts commit 375758a958.

commit 5eb5e446ad
Author: coolneng <akasroua@gmail.com>
Date:   Sun Jan 26 19:39:28 2020 +0100

    Add wallabag docker container

commit 375758a958
Author: coolneng <akasroua@gmail.com>
Date:   Sun Jan 26 08:45:56 2020 +0100

    Clean up packages and refactor nginx config

commit f210353ce5
Author: coolneng <akasroua@gmail.com>
Date:   Tue Dec 31 18:41:34 2019 +0100

    Delete Security folder from Syncthing

commit 65afa32e57
Author: coolneng <akasroua@gmail.com>
Date:   Thu Dec 26 04:19:38 2019 +0100

    Use 'after' instead of 'wantedBy'

commit 8cc829e063
Author: coolneng <akasroua@gmail.com>
Date:   Thu Dec 26 04:16:21 2019 +0100

    Use wantedBy instead of partOf

commit e490102d74
Merge: 91d4b24 51ed142
Author: coolneng <akasroua@gmail.com>
Date:   Wed Dec 25 17:47:14 2019 +0100

    Merge branch 'test' of gitea into test

commit 51ed142c5f
Author: coolneng <akasroua@gmail.com>
Date:   Wed Dec 25 17:15:42 2019 +0100

    Use mkforce for 'partOf' option

commit caf4a49ec2
Author: coolneng <akasroua@gmail.com>
Date:   Wed Dec 25 16:37:11 2019 +0100

    Configure nginx service as dependent on gitea

commit e8850eff51
Author: coolneng <akasroua@gmail.com>
Date:   Wed Dec 25 16:24:10 2019 +0100

    Restart nginx after Gitea

commit 91d4b240d7
Author: coolneng <akasroua@gmail.com>
Date:   Sun Dec 15 22:54:00 2019 +0100

    # This is a combination of 2 commits.
    # This is the 1st commit message:

    Revert "Disable wizard on Gitea"

    This reverts commit d8b415ee16.

    # This is the commit message #2:

    Remove Gitea socket connection to the DB

configuration.nix

@@ -19,7 +19,6 @@
   environment.systemPackages = with pkgs; [
     raspberrypi-tools
     git
-    tmux
     htop
     vim
   ];
@@ -69,32 +68,20 @@
   # Auto-upgrade the system and reboot if needed
   system.autoUpgrade = {
     enable = true;
-    allowReboot = false;
+    allowReboot = true;
-  };
-
-  # Enable zeroconf
-  services.avahi = {
-    enable = true;
-    nssmdns = true;
-    publish = {
-      enable = true;
-      userServices = true;
-    };
   };
 
   # Run Nix garbage collector daily
   nix.gc = {
     automatic = true;
     dates = "03:15";
+    options = "--delete-older-than 14d";
   };
 
   # Configure fish shell
   programs.fish.enable = true;
   users.users.root.shell = "/run/current-system/sw/bin/fish";
 
-  # Start a tmux session
-  #programs.tmux.enable = true;
-
   # Import other configuration modules
   imports = [
     ./modules/printing.nix

modules/datasync.nix

@@ -15,8 +15,8 @@
     dataDir = "/vault/syncthing";
     declarative = {
       devices = {
-        monolith = { id = "QGDGEZQ-INE7XDY-DNX2QI4-QI7ANQJ-57REEO2-FUMH545-FZS5RYU-ULF7HA2"; };
+        monolith = { id = "64P2YDH-S5V7PKM-XXBOSXC-WEXUSC7-B553ELI-6IJ3CPJ-ZFB3YA5-MTKAFAH"; };
-        roamer = { id = "DS3PJH3-J6SNMHM-XUJTDLO-DHGJL5U-J3RUMAG-4OSJWIK-VSJSDVJ-PIHZ2QP"; };
+        roamer = { id = "XE6YPFU-TB7ARWF-7NDSJ35-2PBNNDS-VTXGGCH-KC2UBLE-UHWAXH3-MWD26A5"; };
         unit = { id = "VYHHL4A-KJ6WUYQ-4SNWNA3-YRCFTHE-52ZTRLP-4LV6ZDV-4VAJLHC-RJXYYQY"; };
       };
       folders = {
@@ -24,21 +24,18 @@
        "Notes" = { devices = [ "monolith" "roamer" "unit" ]; id = "kafhz-bfmzm"; };
        "Music" = { devices = [ "monolith" "roamer" "unit" ]; id = "2aqt7-vpprc"; };
        "Photos" = { devices = [ "monolith" "roamer" "unit" ]; id = "mjibc-ustcg"; };
-       "Security" = { devices = [ "monolith" "roamer" "unit" ]; id = "z4lpn-pmm3v"; };
        "Projects" = { devices = [ "monolith" "unit" ]; id = "cjhmu-avy9v"; };
 
         Documents.type = "receiveonly";
         Notes.type = "receiveonly";
         Music.type = "receiveonly";
         Photos.type = "receiveonly";
-        Security.type = "receiveonly";
         Projects.type = "receiveonly";
 
         Documents.path = "/vault/syncthing/Documents";
         Notes.path = "/vault/syncthing/Notes";
         Music.path = "/vault/syncthing/Music";
         Photos.path = "/vault/syncthing/Photos";
-        Security.path = "/vault/syncthing/Security";
         Projects.path = "/vault/syncthing/Projects";
       };
     };

modules/devops.nix

@@ -1,10 +1,6 @@
 # Software development configuration
 { config, pkgs, lib, ... }:
 {
-  environment.systemPackages = with pkgs; [
-    gitea
-  ];
-
   # Gitea setup with daily backup
   services.gitea = {
     enable = true;
@@ -20,5 +16,4 @@
     dump.enable = true;
     appName = "Gitea";
   };
-
 }

modules/networking.nix

@@ -6,9 +6,22 @@
 {
 
   environment.systemPackages = with pkgs; [
-    ddclient
+    wireguard
+    wireguard-tools
   ];
 
+
+  # Enable zeroconf
+  services.avahi = {
+    enable = true;
+    nssmdns = true;
+    publish = {
+      enable = true;
+      userServices = true;
+    };
+  };
+
+
   # Dynamic DNS configuration
   services.ddclient = {
     enable = true;
@@ -26,11 +39,46 @@
       80
       443
     ];
+    allowedUDPPorts = [
+      51820 # Wireguard
+    ];
     autoLoadConntrackHelpers = true;
     connectionTrackingModules = [ "sane" ];
+    extraCommands = ''
+        iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
+        '';
   };
 
   # Disable IPv6
   networking.enableIPv6 = false;
+
+  # Enable NAT for wireguard
+  networking.nat = {
+    enable = true;
+    externalInterface = "eth0";
+    internalInterfaces = [ "wg0" ];
+  };
+
+  # Wireguard setup
+  networking.wireguard.interfaces = {
+    wg0 = {
+      ips = [ "10.8.0.1/24" ];
+      listenPort = 51820;
+      privateKeyFile = "/home/coolneng/.wg/keys/privatekey";
+      peers = [
+        # Monolith
+        {
+          publicKey = "ka9a/VB49XMtrMw/ZJmZHThfk2Y5D/8wErLPtN+KvHE=";
+          allowedIPs = [ "10.8.0.2/32" ];
+        }
+        # Roamer
+        {
+          publicKey = "gS5VIUFL74kTs3zxVNT/ijWyOjeAFLEqWynD0Pefh1o=";
+          allowedIPs = [ "10.8.0.3/32" ];
+        }
+      ];
+    };
+  };
+
 }
 

modules/webstack.nix

@@ -133,4 +133,8 @@
     };
   };
 
+
+  # Restart nginx after
+  systemd.services.nginx.after = [ "gitea.service" "syncthing.service" "miniflux.service" ];
+
 }