- wireguard.<n>.sourceAddresses: source for router-originated traffic
into a tunnel without an address of its own (PreferredSource on the
routes); checked at build time.
- examples/home: antigua's routing role ported to the router module
(PPPoE with IPv6 inside the session, LAN with ULA and reservation,
local DNS and forward zones, the freifunk/family/mobile tunnels with
explicit zone rules, ddclient following the PPP device).
nixosConfigurations.home, packages.installer-home and a flake check
that builds it.
- PLAN.md: the remaining antigua gaps and the open question about
services that stay behind the router.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
router.wireguard.<name> configures tunnels through networkd: road warrior
(listening, dual-stack), site-to-site (no transfer network) and provider
dial-out with masquerade. A tunnel has a zone like a LAN, so inter-zone rules
apply; management, DNS and internet are opt-in. Peers' allowedIPs become
routes (destination-based routing; default-route tunnels are rejected).
Tunnels have a kill switch (default on): forwarded packets for their
allowedIPs are dropped if they would leave via an uplink, before the
established-accept so flows that used the tunnel are cut too.
Private keys stay outside the Nix store and are passed to the unprivileged
systemd-networkd with LoadCredential, so key files can be root-only.
Assertions cover CIDR/key/endpoint formats, duplicate allowedIPs, overlaps
with LAN subnets, port and device clashes, and rule destinations inside
tunnel networks. A five-VM `wireguard` check covers road warrior, site-to-site,
the provider tunnel with an IPv6 transfer net, zone rules and the kill switch.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
nilsandClaude Sonnet 5.5