VPN¶

WireGuard VPN configuration for confining services to a network namespace.

nixflix.vpn.enable¶

Whether to enable WireGuard VPN. Configures Wireguard in a network namespace named wg. This is independent of the host network namespace. The host network remains untouched. This means that you can run another VPN client (Wireguard, Mullvad CLI, Tailscale, etc) on the host if you wish and both VPNs will work independently.

When enabled, most Nixflix services can also be added to the VPN vpnConfinement with nixflix.<service>.vpn.enable = true;.

Any systemd service can be added to the VPN confinement manually with the following code:

systemd.services.<serviceName>.vpnConfinement = {
  enable = true;
  vpnNamespace = "wg";
};
vpnNamespaces.wg.portMappings = [
  {
    from = <servicePort>;
    to = <servicePort>;
    protocol = "tcp";
  }
];

false

true

nixflix.vpn.accessibleFrom¶

List of subnets or addresses in the default network namespace that should be able to reach services confined in the VPN namespace.

Required to access VPN-confined services (e.g. Radarr, Sonarr) from your local network. Example: ["192.168.1.0/24"].

[
  "192.168.1.0/24"
]

[
  "192.168.1.0/24"
]

nixflix.vpn.openVPNPorts¶

Ports to open through the VPN interface, e.g. for port forwarding provided by the VPN provider (AirVPN, IVPN, etc.).

[ ]

[
  {
    port = 60729;
    protocol = "both";
  }
]

nixflix.vpn.openVPNPorts.*.port¶

Port number to open through the VPN interface.

nixflix.vpn.openVPNPorts.*.protocol¶

Protocol for the port.

"tcp"

nixflix.vpn.wgConfFile¶

Path to a wg-quick compatible WireGuard configuration file.

The file must contain at least [Interface] with Address, PrivateKey, and DNS fields, and one or more [Peer] sections with PublicKey, Endpoint, and AllowedIPs.

This file is read at service startup. Use a path to a file managed by your secrets solution (e.g. agenix, sops-nix) to keep the private key out of the Nix store.

"/etc/wireguard/airvpn.conf"