About me: My name is Solène Rapenne, pronouns she/her. I like learning and sharing knowledge. Hobbies: '(NixOS BSD OpenBSD Lisp cmdline gaming security QubesOS internet-stuff). I love percent and lambda characters. OpenBSD developer solene@.

Contact me: solene+www at dataswamp dot org or @solene@bsd.network (mastodon). If for some reason you want to support my work, this is my paypal address: donate@perso.pw.

Consider sponsoring me on Patreon to help me writing this blog and contributing to Free Software as my daily job.

How to use WireGuard VPN on Guix

Written by Solène, on 22 May 2021.
Tags: #guix #vpn

Comments on Fediverse/Mastodon

1. Introduction §

Today I had to setup a Wireguard tunnel on my Guix computer (my email server is only reachable from Wireguard) and I struggled a bit to understand from the official documentation how to put the pieces together.

In Guix (the operating system, and not the foreign Guix on an existing distribution) you certainly have a /etc/config.scm file that defines your system. You will have to add the Wireguard configuration in it after generating a private/public keys for your Wireguard.

Guix project website

Guix Wireguard VPN documentation

2. Key generation §

In order to generate Wireguard keys, install the package Wireguard with "guix install wireguard".

# umask 077 # this is so to make files only readable by root
# install -d -o root -g root -m 700 /etc/wireguard
# wg genkey > /etc/wireguard/private.key
# wg pubkey < /etc/wireguard/private.key > /etc/wireguard/public

3. Configuration §

Edit your /etc/config.scm file, in your "(services)" definition, you will define your VPN service. In this example, my Wireguard server is hosted at on port 4433, my system has the IP address, I also defines my public key but my private key is automatically picked up from /etc/wireguard/private.key

(services (append (list
      (service wireguard-service-type
              (addresses '(""))
                 (name "myserver")
                 (endpoint "")
                 (public-key "z+SCmAMgNNvkeaD0nfBu4fCrhk8FaNCa1/HnnbD21wE=")
                 (allowed-ips '(""))))))))

If you have the default "(services %desktop-services)" you need to use "(append " to merge %desktop-services and new services all defined in a "(list ... )" definition.

The "allowed-ips" field is important, Guix will automatically make routes to these networks through the Wireguard interface, if you want to route everything then use "" (you will require a NAT on the other side) and Guix will make the required work to pass all your traffic through the VPN.

At the top of the config.scm file, you must add "vpn" in the services modules, like this:

# I added vpn to the list
(use-service-modules vpn desktop networking ssh xorg)

Once you made the changes, you can use "guix system reconfigure" to make the changes, if you do multiples reconfigure it seems Wireguard doesn't reload correctly, you may have to use "herd restart wireguard-wg0" to properly get the new settings (seems a bug?).

4. Conclusion §

As usual, setting Wireguard is easy but the functional way make it a bit different. It took me some time to figure out where I had to define the Wireguard service in the configuration file.