switch to exwm

6 files changed, 78 insertions, 124 deletions

diff --git a/home.nix b/home.nix
index ee8c5ba..26f3934 100644
--- a/home.nix
+++ b/home.nix
@@ -129,9 +129,9 @@ in
     ];
 
     sessionVariables = {
-      EDITOR = "nvim";
-      VISUAL = "nvim";
-      PAGER = "page";
+      EDITOR = "emacsclient -r";
+      VISUAL = "emacsclient -t";
+      PAGER = "less";
       LESS = "-iR";
       LESSHISTFILE = "/dev/null";
       BROWSER = "qutebrowser";
@@ -304,6 +304,8 @@ in
 
     aerc.enable = true;
 
+    emacs.enable = true;
+
     foot = {
       enable = true;
 
@@ -638,6 +640,16 @@ in
 
     poweralertd.enable = true;
 
+    emacs = {
+      enable = false;
+      client.enable = true;
+      startWithUserSession = true;
+      extraOptions = [
+        "-f"
+        "exwm-wm-mode"
+      ];
+    };
+
     redshift = {
       enable = false;
       dawnTime = "07:00";
diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
index f3259df..9c781ca 100644
--- a/hosts/demiurge/default.nix
+++ b/hosts/demiurge/default.nix
@@ -59,7 +59,7 @@
   # decrypt agenix secrets
   age.secrets = {
     wg0_demiurge.file = ../../secrets/wg0_demiurge.age;
-    wg1_demiurge.file = ../../secrets/wg1_demiurge.age;
+    tailscale_demiurge.file = ../../secrets/tailscale_demiurge.age;
   };
 
   # boot options
@@ -120,109 +120,33 @@
       interface = "eth0";
     };
 
-    wireguard.interfaces = {
-      # mullvad
-      wg0 = {
-        ips = [
-          "10.68.117.111/32"
-          "fc00:bbbb:bbbb:bb01::5:756e/128"
-        ];
-        privateKeyFile = config.age.secrets.wg0_demiurge.path;
-
-        postSetup = ''
-                ip route add 45.134.142.206 via 192.168.1.1
-                ip route add default via 45.134.142.206
-        '';
-        postShutdown = ''
-                ip route del default via 45.134.142.206
-                ip route del 45.134.142.206 via 192.168.1.1
-        '';
-
-        peers = [
-          {
-            allowedIPs = [
-              "0.0.0.0/0"
-              "::0/0"
-            ];
-            endpoint = "45.134.142.206:51820";
-            publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
-          }
-        ];
-      };
-
-      # epistemia
-      wg1 = {
-        ips = [
-          "10.0.13.2/24"
-          "fd00:b0ba:cafe:babe::2/64"
-        ];
-        privateKeyFile = config.age.secrets.wg1_demiurge.path;
-        listenPort = 51820;
-        fwMark = "51821";
-        mtu = 1420;
-
-        #table = "Off";
-        postSetup = ''
-          ip rule add from 10.0.13.0/24 lookup main pref 31000
-          ip rule add from all fwmark 51821 lookup 51821 pref 32000
-          ip route replace default via 192.168.1.1 dev eth0 table 51821
-
-          # NAT iphonebob and allow traffic between peers (when routing through demiurge)
-          ${pkgs.iptables}/bin/iptables -F FORWARD
-          ${pkgs.iptables}/bin/iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE
-          ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -o wg1 -j ACCEPT
-          ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -o wg0 -j ACCEPT
-          ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-        '';
-        preShutdown = ''
-          ip rule del from all fwmark 51821 lookup 51821 pref 32000
-          ip rule del from 10.0.13.0/24 lookup main pref 31000
-          ip route flush table 51821
-
-          ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE
-          ${pkgs.iptables}/bin/iptables -F FORWARD
-        '';
-
-        peers = [
-          # saklas
-          {
-            allowedIPs = [
-              "10.0.13.1/32"
-              "fd00:b0ba:cafe:babe::1/128"
-            ];
-            endpoint = "157.180.125.215:51820";
-            persistentKeepalive = 25;
-            publicKey = "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=";
-          }
-          # hastur
-          {
-            allowedIPs = [
-              "10.0.13.3/32"
-              "fd00:b0ba:cafe:babe::3/128"
-            ];
-            persistentKeepalive = 25;
-            publicKey = "MOmRjVbRuWEuK0oHQ+C0jTaceCUPd2fpzDbh8ue6bDc=";
-          }
-          # iphonebob
-          {
-            allowedIPs = [
-              "10.0.13.4/32"
-              "fd00:b0ba:cafe:babe::4/128"
-            ];
-            persistentKeepalive = 25;
-            publicKey = "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=";
-          }
-          # lab
-          {
-            allowedIPs = [
-              "10.0.13.5/32"
-              "fd00:b0ba:cafe:babe::5/128"
-            ];
-            persistentKeepalive = 25;
-            publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=";
-          }
-        ];
-      };
+    # mullvad
+    wireguard.interfaces.wg0 = {
+      ips = [
+        "10.68.117.111/32"
+        "fc00:bbbb:bbbb:bb01::5:756e/128"
+      ];
+      privateKeyFile = config.age.secrets.wg0_demiurge.path;
+
+      postSetup = ''
+                        ip route add 45.134.142.206 via 192.168.1.1
+                        ip route add default via 45.134.142.206
+                '';
+      postShutdown = ''
+                        ip route del default via 45.134.142.206
+                        ip route del 45.134.142.206 via 192.168.1.1
+                '';
+
+      peers = [
+        {
+          allowedIPs = [
+            "0.0.0.0/0"
+            "::0/0"
+          ];
+          endpoint = "45.134.142.206:51820";
+          publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
+        }
+      ];
     };
   };
 
@@ -390,6 +314,19 @@
       };
     };
 
+    # vpn
+    tailscale = {
+      enable = true;
+      authKeyFile = config.age.secrets.tailscale_demiurge.path;
+      disableTaildrop = true;
+      disableUpstreamLogging = true;
+      extraSetFlags = [ "--advertise-exit-node" ];
+      #extraUpFlags = [ "--login-server=https://headscale.13f0.net" ];
+      extraUpFlags = [ "--login-server=https://controlplane.tailscale.com" ];
+      openFirewall = true;
+      useRoutingFeatures = "both";
+    };
+
     # automatically scrub zfs pools (every week by default)
     zfs.autoScrub.enable = true;
 
@@ -1154,21 +1091,10 @@
 
   # extra systemd stuff
   systemd.services = {
-    nginx = {
-      after = [ "wireguard-wg1.service" ];
-      requires = [ "wireguard-wg1.service" ];
-      serviceConfig.Type = lib.mkForce "idle";
-    };
-
-    wireguard-wg0 = {
-      after = [ "network-addresses-eth0.service" ];
-      requires = [ "network-addresses-eth0.service" ];
-    };
-
-    wireguard-wg1 = {
-      after = [ "wireguard-wg0.service" ];
-      requires = [ "wireguard-wg0.service" ];
-    };
+    #nginx = {
+    #  after = [ "wireguard-wg1.service" ];
+    #  serviceConfig.Type = lib.mkForce "idle";
+    #};
   };
 
   # create caches and use mandoc
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 0d46c6d..4bfeab9 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -20,8 +20,9 @@ in
 
   "wg0_demiurge.age".publicKeys = users ++ [ demiurge ];
   "wg0_hastur.age".publicKeys = users ++ [ hastur ];
-  "wg1_demiurge.age".publicKeys = users ++ [ demiurge ];
-  "wg1_hastur.age".publicKeys = users ++ [ hastur ];
+  "tailscale_demiurge.age".publicKeys = users ++ [ demiurge ];
+  "tailscale_hastur.age".publicKeys = users ++ [ hastur ];
+  "tailscale_saklas.age".publicKeys = users ++ [ saklas ];
 
   "wpa_supplicant.age".publicKeys = users ++ [ hastur ];
 }
diff --git a/secrets/tailscale_demiurge.age b/secrets/tailscale_demiurge.age
new file mode 100644
index 0000000..a855cf0
--- /dev/null
+++ b/secrets/tailscale_demiurge.age
diff --git a/secrets/tailscale_hastur.age b/secrets/tailscale_hastur.age
new file mode 100644
index 0000000..420e7c8
--- /dev/null
+++ b/secrets/tailscale_hastur.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 AaF/mQ ZhtqaDNCYfckXuWoIPlmf6VMSZIbEoKROUTVsC3QJ2w
+bQVjId8jiQXIUarsPUYwLEGof4W4b2gEOnL6ndd7hB8
+-> ssh-ed25519 CQpZUw f3XFvZLovkTydK2odqGU0UZd58s273diGLtku4uLSzQ
+puBoVJ9Cb+m00M1UivQBD2NbxB9QJgeg0W+tv49WW2I
+--- /4rFWR1tyCNnBgRlmH6Yku2GQwASTJ4GQbyQii0TZAo
+�E���,;l���&L�/�@q��.�x���
��8(,��h�Ӿ_їY;aˌh��`�Z�n��(D5T�      ͒,�فr��r:S���zk�j�G�
\ No newline at end of file
diff --git a/secrets/tailscale_saklas.age b/secrets/tailscale_saklas.age
new file mode 100644
index 0000000..b654cbc
--- /dev/null
+++ b/secrets/tailscale_saklas.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 AaF/mQ CFompU5/+edOgTq43LDiW2D1QfWrOCDraA81AwkBfGM
+IxCXSQGTxY5XudpDZsszmRv6PTMwsuGjO926gABKfIY
+-> ssh-ed25519 hc2ELA LitSyMM/w8BfhK6KlXu3Vcyc8nw1gMPHnXgnaWB1tDc
+lw5E5c5eoPj5H4kdg3P23LTY+Rp3tdfui8vchHwN8Y0
+--- JjsrCNKCL69/V8ullEAbaYmCxmP3LSnjl6BT0HnWZV4
+�tp���M�^��/�BPhH�"W��P#��m/��ƶ����ږ
�1�
+�8dHޝ�QM���h�A     �"#���m� f�śф���}FCy�H
\ No newline at end of file