54 lines
1.0 KiB
Nix
Executable File
54 lines
1.0 KiB
Nix
Executable File
{
|
|
pkgs,
|
|
config,
|
|
lib,
|
|
inputs,
|
|
...
|
|
}: let
|
|
cfg = config.system.vpn-confinement;
|
|
in {
|
|
imports = [inputs.vpn-confinement.nixosModules.default];
|
|
|
|
options.system.vpn-confinement = {
|
|
enable = lib.mkEnableOption "enables vpn-confinement";
|
|
|
|
# toggle for mullvad mexico w/ openvpn
|
|
vpncon_mex = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = "enable pia vpn to mexico using openvpn";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
# Define VPN network namespace
|
|
vpnNamespaces.wgmex = {
|
|
enable = true;
|
|
wireguardConfigFile = "/etc/wireguard/mullvad.conf";
|
|
accessibleFrom = [
|
|
"10.0.0.0/8"
|
|
];
|
|
portMappings = [
|
|
{
|
|
from = 7103;
|
|
to = 7103;
|
|
}
|
|
];
|
|
openVPNPorts = [
|
|
{
|
|
port = 51820;
|
|
protocol = "both";
|
|
}
|
|
];
|
|
};
|
|
|
|
# secrets only if VPN is enabled
|
|
sops.secrets = {
|
|
"vpncon_mex_config" = {
|
|
owner = "root";
|
|
group = "root";
|
|
};
|
|
};
|
|
};
|
|
}
|