Wireguard on Guix
On my Guix system I didn't bother with manually creating the public and private keys, Guix did it for me.
So all I had to do was add configuration, fetch my public key, and allow it to connect to my VPS.
Here's what I put in my services:
T282828
Tb4b4b4(Te6edf3service Te6edf3wireguardTff7b72-Te6edf3serviceTff7b72-Tff7b72type
Tb4b4b4(Te6edf3wireguardTff7b72-Te6edf3configuration
Tb4b4b4(Tff7b72interface Ta5d6ff"wg0"Tb4b4b4)
Tb4b4b4(Te6edf3addresses 'Tb4b4b4(Ta5d6ff"192.168.42.4/32"Tb4b4b4)Tb4b4b4)
Tb4b4b4(Te6edf3peers
Tb4b4b4(Te6edf3list
Tb4b4b4(Te6edf3wireguardTff7b72-Te6edf3peer
Tb4b4b4(Te6edf3name Ta5d6ff"comehackme"Tb4b4b4)
Tb4b4b4(Te6edf3endpoint Ta5d6ff"my-vps-host:51820"Tb4b4b4)
Tb4b4b4(Te6edf3publicTff7b72-Te6edf3key Ta5d6ff"b4PzzWUSgfON2c/zoFQcJrlaBB7zIIJqbhIQmKcE2Hc="Tb4b4b4)
Tb4b4b4(Te6edf3allowedTff7b72-Te6edf3ips 'Tb4b4b4(Ta5d6ff"192.168.42.2/24"Tb4b4b4)Tb4b4b4)Tb4b4b4)
Tb4b4b4)
Tb4b4b4)
Tb4b4b4)
Tb4b4b4)
Notable elements:
• this system's Wireguard IP 192.168.42.4
• connects to T383838my-vps-host
• this snippet can be reused to add new Guix systems
• omitted T383838postUp because this system is not providing services
I'm using T383838192.168.42.0/24 for my wireguard network. My address on the Guix system is T383838192.168.42.4. The system that will do the routing will have a wireguard IP address of T383838192.168.42.2.
So why specify the T383838.2 in the allowed IPs if the T383838/24 is going to mask it off so it only pays attention to the T383838192.168.42 part? So I've got a reminder that the remote peer I'm connecting to (whose public key is specified above) is the T383838.2 system. If I wanted all the traffic from the Guix system to be routed through the VPS and not just the traffic for other systems on the wireguard network, then I would use T3838380.0.0.0/0 here. Then when the wireguard network is up, it would be used as the default route like most VPNs.
The remote VPS system host name (which must be routable) is T383838my-vps-host in the above example. A host name or IP works there. I don't want to put the real one here because the real one is also a placeholder and would just need to be changed when I make it all live.
For the other peer, I need my public key, for which I can:
sudo wg
And it will show me something like:
interface: wg0
public key: my-pulic-key-is-here
private key: (hidden)
listening port: 51820
The other peer setup is covered here: Wireguard on NixOS.
One tiny little caveat: While making changes to my T383838config.scm file the wireguard service wasn't restarting after I did a T383838guix system reconfigure /etc/config.scm and I had to manually do (as root or via sudo) T383838herd restart wireguard-wg0 and then it was all good.
While debugging, I found it helpful to do a T383838sudo watch wg so that I could see when nodes were establishing their endpoints. I also used ping from nodes to get the connection going from the peers to the VPS so that other peers could then reach them. That's when I figured out the purpose of a keep-alive which I'm using on my media server.
Tags: index, guix, wireguard
Tags
Navigation
Backlinks