commit b968cac8a771274b635fd357426781ef64f79c05 parent 4a717e1175dd29416eabe62fcf597cdb77358bb1 Author: Vineet Kumar <git@vineetk.net> Date: Sun, 25 Jan 2026 04:02:27 -0500 demiurge: go back to cronjob for wireguard route updating the rule-based method I tried doing (that incidentally isn't portable like outside of linux) wasn't working that well. I still had to run the route updater script at times. Diffstat:
| M | epistemia/systems/demiurge.scm | | | 19 | ++++++++++--------- |
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/epistemia/systems/demiurge.scm b/epistemia/systems/demiurge.scm @@ -259,17 +259,10 @@ rpz: #~(string-append #$(file-append iptables "/sbin/ip6tables") " -I FORWARD 1 -j WG1-FWD") #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT") #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT") - #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT") - - ;; force saklas endpoint through wg0 (Mullvad); I can't connect otherwise - "ip rule add to 157.180.125.215/32 lookup 51820 priority 50" - - ;; Set fwmark on wg1 interface to bypass wg0 (Mullvad) - #~(string-append #$(file-append wireguard-tools "/bin/wg") " set wg1 fwmark 51820"))) + #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT"))) (pre-down ;; IPv4 and IPv6 NAT - (list "ip rule del to 157.180.125.215/32 lookup 51820 || true" - #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE") + (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE") #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE") ;; IPv4 Forwarding Chain @@ -304,6 +297,14 @@ rpz: (public-key "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=") (allowed-ips '("10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128")) (keep-alive 25)))))) + (simple-service 'wireguard-route-timer + shepherd-root-service-type + (list (shepherd-timer + '(wg1-route-updater) + "* * * * *" + #~("/data_hdd/wireguard-endpoint-route") + #:requirement '(wireguard-wg1) + #:documentation "Update Wireguard routes every minute."))) (service nginx-service-type (nginx-configuration (server-blocks