yanlin/nix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

replace wireguard with tailscale

Browse source
This commit is contained in:
Yan Lin 2025-11-29 17:53:36 +01:00
parent f5fff0f4c3
commit f29fd6cd0d
5 changed files with 64 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

15
hosts/nixos/hs/system.nix
View file

@ -4,7 +4,7 @@
./containers.nix
./proxy.nix
../system-default.nix
../../../modules/wireguard.nix
../../../modules/tailscale.nix
../../../modules/podman.nix
../../../modules/traefik.nix
../../../modules/borg/client.nix
@ -257,16 +257,9 @@
'';
};
# WireGuard VPN configuration (HS as client/spoke)
services.wireguard-custom = {
enable = true;
mode = "client";
clientConfig = {
address = "10.2.2.20/24";
serverPublicKey = "46QHjSzAas5g9Hll1SCEu9tbR5owCxXAy6wGOUoPwUM=";
serverEndpoint = "91.98.84.215:51820";
allowedIPs = [ "10.2.2.0/24" ];
};
services.tailscale-custom = {
exitNode = true;
subnetRoutes = [ "10.1.1.0/24" ];
};
# Samba file sharing

15
hosts/nixos/thinkpad/system.nix
View file

@ -5,7 +5,7 @@
./hardware-configuration.nix
../system-default.nix
../../../modules/hyprland/system.nix
../../../modules/wireguard.nix
../../../modules/tailscale.nix
../../../modules/login-display.nix
../../../modules/dufs.nix
];
@ -230,18 +230,7 @@
# Apply XKB config to console (TTY) as well
console.useXkbConfig = true;
# WireGuard VPN configuration (ThinkPad as client/spoke)
services.wireguard-custom = {
enable = true;
mode = "client";
privateKeyFile = "/etc/wireguard/thinkpad_private.key";
clientConfig = {
address = "10.2.2.30/24";
serverPublicKey = "46QHjSzAas5g9Hll1SCEu9tbR5owCxXAy6wGOUoPwUM=";
serverEndpoint = "91.98.84.215:51820";
allowedIPs = [ "10.2.2.0/24" ];
};
};
services.tailscale-custom.exitNode = true;
# Login display with SMART disk health status
services.login-display = {

30
hosts/nixos/vps/system.nix
View file

@ -4,7 +4,7 @@
./containers.nix
./proxy.nix
../system-default.nix
../../../modules/wireguard.nix
../../../modules/tailscale.nix
../../../modules/podman.nix
../../../modules/traefik.nix
../../../modules/borg/client.nix
@ -42,7 +42,7 @@
firewall = {
enable = true;
allowedTCPPorts = [ 22 80 443 ]; # SSH, HTTP, HTTPS
trustedInterfaces = [ "wg0" ]; # Allow all traffic through WireGuard interface
trustedInterfaces = [ "tailscale0" ];
};
};
@ -109,30 +109,6 @@
showBorgStatus = true;
};
# WireGuard VPN configuration (VPS as hub/server)
services.wireguard-custom = {
enable = true;
mode = "server";
serverConfig = {
address = "10.2.2.1/24";
peers = [
{
name = "hs";
publicKey = "HZY7V8QlnFvY6ZWNiI0WgUgWUISnEqUdzXi7Oq9M1Es=";
allowedIPs = [ "10.2.2.20/32" ];
}
{
name = "thinkpad";
publicKey = "p3442J2HBGY5Pksu+0F4SFkBGjG99KIgwyk8eAt4YmA=";
allowedIPs = [ "10.2.2.30/32" ];
}
{
name = "rpi-wg-10-2-2-200";
publicKey = "vA+jDEtpkqHG0h3AfE0sZXuvw7kkLy/rq5VwwtCOnyE=";
allowedIPs = [ "10.2.2.200/32" ];
}
];
};
};
services.tailscale-custom.exitNode = true;
}