refactoring vpns

2025-10-08 12:46:17 -05:00
parent a72b92c43c
commit ea9007278f
4 changed files with 41 additions and 99 deletions
--- a/modules/system/vpns.nix
+++ b/modules/system/vpns.nix
@@ -13,6 +13,11 @@ in
      default = false;
      description = "enable pia vpn to mexico using openvpn";
    };
+     wg_pia_mexico = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "enable pia vpn to mexico using wireguard";
+    };
    
  };

@@ -22,101 +27,37 @@ in
    services.openvpn.servers = lib.mkIf cfg.openvpn_pia_mexico { 
      openvpn_pia_mexico = {
        config = ''
-          client
-          dev tun
-          proto udp
-          remote 77.81.142.240 1198
-          resolv-retry infinite
-          nobind
-          persist-key
-          persist-tun
-          cipher aes-128-cbc
-          auth sha1
-          tls-client
-          remote-cert-tls server
-
-          auth-user-pass /run/secrets/openvpn_pia_mexico_auth
-          compress
-          verb 1
-          reneg-sec 0
-          <crl-verify>
-          -----BEGIN X509 CRL-----
-          MIICWDCCAUAwDQYJKoZIhvcNAQENBQAwgegxCzAJBgNVBAYTAlVTMQswCQYDVQQI
-          EwJDQTETMBEGA1UEBxMKTG9zQW5nZWxlczEgMB4GA1UEChMXUHJpdmF0ZSBJbnRl
-          cm5ldCBBY2Nlc3MxIDAeBgNVBAsTF1ByaXZhdGUgSW50ZXJuZXQgQWNjZXNzMSAw
-          HgYDVQQDExdQcml2YXRlIEludGVybmV0IEFjY2VzczEgMB4GA1UEKRMXUHJpdmF0
-          ZSBJbnRlcm5ldCBBY2Nlc3MxLzAtBgkqhkiG9w0BCQEWIHNlY3VyZUBwcml2YXRl
-          aW50ZXJuZXRhY2Nlc3MuY29tFw0xNjA3MDgxOTAwNDZaFw0zNjA3MDMxOTAwNDZa
-          MCYwEQIBARcMMTYwNzA4MTkwMDQ2MBECAQYXDDE2MDcwODE5MDA0NjANBgkqhkiG
-          9w0BAQ0FAAOCAQEAQZo9X97ci8EcPYu/uK2HB152OZbeZCINmYyluLDOdcSvg6B5
-          jI+ffKN3laDvczsG6CxmY3jNyc79XVpEYUnq4rT3FfveW1+Ralf+Vf38HdpwB8EW
-          B4hZlQ205+21CALLvZvR8HcPxC9KEnev1mU46wkTiov0EKc+EdRxkj5yMgv0V2Re
-          ze7AP+NQ9ykvDScH4eYCsmufNpIjBLhpLE2cuZZXBLcPhuRzVoU3l7A9lvzG9mjA
-          5YijHJGHNjlWFqyrn1CfYS6koa4TGEPngBoAziWRbDGdhEgJABHrpoaFYaL61zqy
-          MR6jC0K2ps9qyZAN74LEBedEfK7tBOzWMwr58A==
-          -----END X509 CRL-----
-          </crl-verify>
-
-          <ca>
-          -----BEGIN CERTIFICATE-----
-          MIIFqzCCBJOgAwIBAgIJAKZ7D5Yv87qDMA0GCSqGSIb3DQEBDQUAMIHoMQswCQYD
-          VQQGEwJVUzELMAkGA1UECBMCQ0ExEzARBgNVBAcTCkxvc0FuZ2VsZXMxIDAeBgNV
-          BAoTF1ByaXZhdGUgSW50ZXJuZXQgQWNjZXNzMSAwHgYDVQQLExdQcml2YXRlIElu
-          dGVybmV0IEFjY2VzczEgMB4GA1UEAxMXUHJpdmF0ZSBJbnRlcm5ldCBBY2Nlc3Mx
-          IDAeBgNVBCkTF1ByaXZhdGUgSW50ZXJuZXQgQWNjZXNzMS8wLQYJKoZIhvcNAQkB
-          FiBzZWN1cmVAcHJpdmF0ZWludGVybmV0YWNjZXNzLmNvbTAeFw0xNDA0MTcxNzM1
-          MThaFw0zNDA0MTIxNzM1MThaMIHoMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0Ex
-          EzARBgNVBAcTCkxvc0FuZ2VsZXMxIDAeBgNVBAoTF1ByaXZhdGUgSW50ZXJuZXQg
-          QWNjZXNzMSAwHgYDVQQLExdQcml2YXRlIEludGVybmV0IEFjY2VzczEgMB4GA1UE
-          AxMXUHJpdmF0ZSBJbnRlcm5ldCBBY2Nlc3MxIDAeBgNVBCkTF1ByaXZhdGUgSW50
-          ZXJuZXQgQWNjZXNzMS8wLQYJKoZIhvcNAQkBFiBzZWN1cmVAcHJpdmF0ZWludGVy
-          bmV0YWNjZXNzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPXD
-          L1L9tX6DGf36liA7UBTy5I869z0UVo3lImfOs/GSiFKPtInlesP65577nd7UNzzX
-          lH/P/CnFPdBWlLp5ze3HRBCc/Avgr5CdMRkEsySL5GHBZsx6w2cayQ2EcRhVTwWp
-          cdldeNO+pPr9rIgPrtXqT4SWViTQRBeGM8CDxAyTopTsobjSiYZCF9Ta1gunl0G/
-          8Vfp+SXfYCC+ZzWvP+L1pFhPRqzQQ8k+wMZIovObK1s+nlwPaLyayzw9a8sUnvWB
-          /5rGPdIYnQWPgoNlLN9HpSmsAcw2z8DXI9pIxbr74cb3/HSfuYGOLkRqrOk6h4RC
-          OfuWoTrZup1uEOn+fw8CAwEAAaOCAVQwggFQMB0GA1UdDgQWBBQv63nQ/pJAt5tL
-          y8VJcbHe22ZOsjCCAR8GA1UdIwSCARYwggESgBQv63nQ/pJAt5tLy8VJcbHe22ZO
-          sqGB7qSB6zCB6DELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRMwEQYDVQQHEwpM
-          b3NBbmdlbGVzMSAwHgYDVQQKExdQcml2YXRlIEludGVybmV0IEFjY2VzczEgMB4G
-          A1UECxMXUHJpdmF0ZSBJbnRlcm5ldCBBY2Nlc3MxIDAeBgNVBAMTF1ByaXZhdGUg
-          SW50ZXJuZXQgQWNjZXNzMSAwHgYDVQQpExdQcml2YXRlIEludGVybmV0IEFjY2Vz
-          czEvMC0GCSqGSIb3DQEJARYgc2VjdXJlQHByaXZhdGVpbnRlcm5ldGFjY2Vzcy5j
-          b22CCQCmew+WL/O6gzAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBDQUAA4IBAQAn
-          a5PgrtxfwTumD4+3/SYvwoD66cB8IcK//h1mCzAduU8KgUXocLx7QgJWo9lnZ8xU
-          ryXvWab2usg4fqk7FPi00bED4f4qVQFVfGfPZIH9QQ7/48bPM9RyfzImZWUCenK3
-          7pdw4Bvgoys2rHLHbGen7f28knT2j/cbMxd78tQc20TIObGjo8+ISTRclSTRBtyC
-          GohseKYpTS9himFERpUgNtefvYHbn70mIOzfOJFTVqfrptf9jXa9N8Mpy3ayfodz
-          1wiqdteqFXkTYoSDctgKMiZ6GdocK9nMroQipIQtpnwd4yBDWIyC6Bvlkrq5TQUt
-          YDQ8z9v+DMO6iwyIDRiU
-          -----END CERTIFICATE-----
-          </ca>
-          disable-occ
-                  '';
-#        config = ''
-#          config ${config.sops.secrets."openvpn_pia_mexico_config".path}
-#          auth-user-pass /run/secrets/openvpn_pia_mexico_auth
-#        '';
+          config ${config.sops.secrets."openvpn_pia_mexico_config".path}
+          auth-user-pass ${config.sops.secrets."_pia_auth".path}
+        '';
      };
    };
-    sops.secrets = {
-      "openvpn_pia_mexico_auth" = {
-        owner = "blake";
-        group = "blake";
-      };
-      "openvpn_pia_mexico_crl" = {
-        owner = "blake";
-        group = "blake";
-      };
-      "openvpn_pia_mexico_crt" = {
-        owner = "blake";
-        group = "blake";
-      };
-      "openvpn_pia_mexico_config" = {
-        owner = "blake";
-        group = "blake";
+    sops.secrets = lib.mkIf cfg.openvpn_pia_mexico {
+      "pia_auth" = { owner = "root"; group = "root"; };
+      "openvpn_pia_mexico_config" = {owner = "root"; group = "root"; };
+    };
+
+    # enable pia mexico w/ wireguard
+    networking.wireguard.interfaces = lib.mkIf cfg.wg_pia_mexico {
+      wg_piamex = {
+        privateKeyFile = config.sops.secrets."wg_pia_mexico_key".path;
+#        listenPort = 51820;
+        ips = [ "10.4.244.34/32" ];
+
+        peers = {
+          pia = {
+            publicKey = "avK/Bdg+hyLMqP2k/7eEBTkxwCSzyy8FymwO/vFjbQg=";
+            allowedIPs = [ "0.0.0.0/0" ];
+            endpoint = "77.81.142.245:1337";
+            persistentKeepalive = 25;
+          };
+        };
      };
    };
+
+    # secrets only if VPN is enabled
+    sops.secrets = lib.mkIf cfg.wireguard_pia_mexico {
+      "wg_pia_mexico_key" = { owner = "root"; group = "root"; };
+    };
  };
 }