VPN¶

WireGuard VPN configuration for confining services to a network namespace.

nixflix.vpn.enable¶

Whether to enable WireGuard VPN.

false

true

nixflix.vpn.accessibleFrom¶

List of subnets or addresses in the default network namespace that should be able to reach services confined in the VPN namespace.

Required to access VPN-confined services (e.g. Radarr, Sonarr) from your local network. Example: ["192.168.1.0/24"].

[
  "192.168.1.0/24"
]

[
  "192.168.1.0/24"
]

nixflix.vpn.openVPNPorts¶

Ports to open through the VPN interface, e.g. for port forwarding provided by the VPN provider (AirVPN, IVPN, etc.).

[ ]

[
  {
    port = 60729;
    protocol = "both";
  }
]

nixflix.vpn.openVPNPorts.*.port¶

Port number to open through the VPN interface.

nixflix.vpn.openVPNPorts.*.protocol¶

Protocol for the port.

"tcp"

nixflix.vpn.wgConfFile¶

Path to a wg-quick compatible WireGuard configuration file.

The file must contain at least [Interface] with Address, PrivateKey, and DNS fields, and one or more [Peer] sections with PublicKey, Endpoint, and AllowedIPs.

This file is read at service startup. Use a path to a file managed by your secrets solution (e.g. agenix, sops-nix) to keep the private key out of the Nix store.

"/etc/wireguard/airvpn.conf"