42 lines
939 B
Nix
42 lines
939 B
Nix
{ pkgs, config, lib, ... }:
|
|
|
|
let
|
|
cfg = config.modules.system.vpn-confinement;
|
|
in
|
|
{
|
|
options.modules.system.vpn-confinement = {
|
|
enable = lib.mkEnableOption "enables vpn-confinement";
|
|
|
|
# toggle for mullvad mexico w/ openvpn
|
|
vpncon_mex = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = "enable pia vpn to mexico using openvpn";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
|
|
# Define VPN network namespace
|
|
vpnNamespaces.wgmex = {
|
|
enable = true;
|
|
wireguardConfigFile = config.sops.secrets."vpncon_mex_config".path;
|
|
accessibleFrom = [
|
|
"10.0.0.0/8"
|
|
];
|
|
portMappings = [
|
|
{ from = 7000; to = 7200; }
|
|
];
|
|
openVPNPorts = [{
|
|
port = 7103;
|
|
protocol = "both";
|
|
}];
|
|
};
|
|
|
|
# secrets only if VPN is enabled
|
|
sops.secrets = {
|
|
"vpncon_mex_config" = { owner = "root"; group = "root"; };
|
|
};
|
|
};
|
|
}
|