Wg quick
networking.wg-quick.interfaces
Wireguard interfaces.
Type: attribute set of (submodule)
Default
{ }
Example
{wg0 = {address = ["192.168.20.4/24"];peers = [{allowedIPs = ["192.168.20.1/32"];endpoint = "demo.wireguard.io:12913";publicKey = "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=";}];privateKey = "yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk=";};}
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.address
The IP addresses of the interface.
Type: list of string
Default
[ ]
Example
["192.168.2.1/24"]
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.autostart
Whether to bring up this interface automatically during boot.
Type: boolean
Default
true
Example
false
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.configFile
wg-quick .conf file, describing the interface. Using this option can be a useful means of configuring WireGuard if one has an existing .conf file. This overrides any other configuration interface configuration options. See wg-quick manpage for more details.
Type: null or string
Default
null
Example
"/secret/wg0.conf"
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.dns
The IP addresses of DNS servers to configure.
Type: list of string
Default
[ ]
Example
["192.168.2.2"]
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.listenPort
16-bit port for listening. Optional; if not specified, automatically generated based on interface name.
Type: null or signed integer
Default
null
Example
51820
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.mtu
If not specified, the MTU is automatically determined from the endpoint addresses or the system default route, which is usually a sane choice. However, to manually specify an MTU to override this automatic discovery, this value may be specified explicitly.
Type: null or signed integer
Default
null
Example
1248
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.peers
Peers linked to the interface.
Type: list of (submodule)
Default
[ ]
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.peers.*.allowedIPs
List of IP (v4 or v6) addresses with CIDR masks from
which this peer is allowed to send incoming traffic and to which
outgoing traffic for this peer is directed. The catch-all 0.0.0.0/0 may
be specified for matching all IPv4 addresses, and ::/0 may be specified
for matching all IPv6 addresses.
Type: list of string
Example
["10.192.122.3/32""10.192.124.1/24"]
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.peers.*.endpoint
Endpoint IP or hostname of the peer, followed by a colon,
and then a port number of the peer.
Type: null or string
Default
null
Example
"demo.wireguard.io:12913"
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.peers.*.persistentKeepalive
This is optional and is by default off, because most
users will not need it. It represents, in seconds, between 1 and 65535
inclusive, how often to send an authenticated empty packet to the peer,
for the purpose of keeping a stateful firewall or NAT mapping valid
persistently. For example, if the interface very rarely sends traffic,
but it might at anytime receive traffic from a peer, and it is behind
NAT, the interface might benefit from having a persistent keepalive
interval of 25 seconds; however, most users will not need this.
Type: null or signed integer
Default
null
Example
25
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.peers.*.presharedKey
Base64 preshared key generated by {command}wg genpsk.
Optional, and may be omitted. This option adds an additional layer of
symmetric-key cryptography to be mixed into the already existing
public-key cryptography, for post-quantum resistance.
Warning: Consider using presharedKeyFile instead if you do not want to store the key in the world-readable Nix store.
Type: null or string
Default
null
Example
"rVXs/Ni9tu3oDBLS4hOyAUAa1qTWVA3loR8eL20os3I="
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.peers.*.presharedKeyFile
File pointing to preshared key as generated by {command}wg genpsk.
Optional, and may be omitted. This option adds an additional layer of
symmetric-key cryptography to be mixed into the already existing
public-key cryptography, for post-quantum resistance.
Type: null or string
Default
null
Example
"/private/wireguard_psk"
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.peers.*.publicKey
The base64 public key to the peer.
Type: string
Example
"xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg="
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.postDown
Command called after the interface is taken down.
Type: strings concatenated with "\n" or (list of string) convertible to it
Default
""
Example
"${pkgs.iproute2}/bin/ip netns del foo"
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.postUp
Commands called after the interface setup.
Type: strings concatenated with "\n" or (list of string) convertible to it
Default
""
Example
"${pkgs.iproute2}/bin/ip netns add foo"
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.preDown
Command called before the interface is taken down.
Type: strings concatenated with "\n" or (list of string) convertible to it
Default
""
Example
"${pkgs.iproute2}/bin/ip netns del foo"
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.preUp
Commands called at the start of the interface setup.
Type: strings concatenated with "\n" or (list of string) convertible to it
Default
""
Example
"${pkgs.iproute2}/bin/ip netns add foo"
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.privateKey
Base64 private key generated by {command}wg genkey.
Warning: Consider using privateKeyFile instead if you do not want to store the key in the world-readable Nix store.
Type: null or string
Default
null
Example
"yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk="
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.privateKeyFile
Private key file as generated by {command}wg genkey.
Type: null or string
Default
null
Example
"/private/wireguard_key"
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix
networking.wg-quick.interfaces.<name>.table
The kernel routing table to add this interface's associated routes to. Setting this is useful for e.g. policy routing ("ip rule") or virtual routing and forwarding ("ip vrf"). Both numeric table IDs and table names (/etc/rt_tables) can be used. Defaults to "main".
Type: null or string
Default
null
Example
"main"
Declared by: https://github.com/nixos/nixpkgs/blob/master/nixos/modules/services/networking/wg-quick.nix