nilsandClaude Sonnet 5.5
30ab1a0ed6
router.wireguard.<name> configures tunnels through networkd: road warrior (listening, dual-stack), site-to-site (no transfer network) and provider dial-out with masquerade. A tunnel has a zone like a LAN, so inter-zone rules apply; management, DNS and internet are opt-in. Peers' allowedIPs become routes (destination-based routing; default-route tunnels are rejected). Tunnels have a kill switch (default on): forwarded packets for their allowedIPs are dropped if they would leave via an uplink, before the established-accept so flows that used the tunnel are cut too. Private keys stay outside the Nix store and are passed to the unprivileged systemd-networkd with LoadCredential, so key files can be root-only. Assertions cover CIDR/key/endpoint formats, duplicate allowedIPs, overlaps with LAN subnets, port and device clashes, and rule destinations inside tunnel networks. A five-VM `wireguard` check covers road warrior, site-to-site, the provider tunnel with an IPv6 transfer net, zone rules and the kill switch. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
13 lines
373 B
Nix
13 lines
373 B
Nix
{ self, pkgs }:
|
|
{
|
|
basic = import ./basic.nix { inherit self pkgs; };
|
|
pppoe = import ./basic.nix {
|
|
inherit self pkgs;
|
|
wan4 = "pppoe";
|
|
};
|
|
vlans = import ./vlans.nix { inherit self pkgs; };
|
|
wireguard = import ./wireguard.nix { inherit self pkgs; };
|
|
lib = import ./lib.nix { inherit pkgs; };
|
|
assertions = import ./assertions.nix { inherit self pkgs; };
|
|
}
|