remove tailscale

2 files changed, 106 insertions, 50 deletions

diff --git a/flake.lock b/flake.lock
index ff49e7e..648b7d4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1754433428,
-        "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
+        "lastModified": 1762618334,
+        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
+        "rev": "fcdea223397448d35d9b31f798479227e80183f6",
         "type": "github"
       },
       "original": {
@@ -163,11 +163,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1759536080,
-        "narHash": "sha256-0aXlKPxm2M+F5oywX2TTbY0e6h+tQ+6OYyx7UZn3A4A=",
+        "lastModified": 1765337252,
+        "narHash": "sha256-HuWQp8fM25fyWflbuunQkQI62Hg0ecJxWD52FAgmxqY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "edafd6da1936426708f1be0b1a4288007f16639a",
+        "rev": "13cc1efd78b943b98c08d74c9060a5b59bf86921",
         "type": "github"
       },
       "original": {
@@ -184,8 +184,8 @@
         ]
       },
       "locked": {
-        "lastModified": 1759197167,
-        "narHash": "sha256-AwyoFll5dXyxLtipAdfthKSPKaL0nifDEhAKQ8baV1c=",
+        "lastModified": 0,
+        "narHash": "sha256-55vcu6qdgWbK8AczPidx3oZch+2lgxIT0wXT3m69z54=",
         "path": "/data/src/clones/llm/llama.cpp",
         "type": "path"
       },
@@ -211,11 +211,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1759381078,
-        "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
+        "lastModified": 1765186076,
+        "narHash": "sha256-hM20uyap1a0M9d344I692r+ik4gTMyj60cQWO+hAYP8=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
+        "rev": "addf7cf5f383a3101ecfba091b98d0a1263dc9b8",
         "type": "github"
       },
       "original": {
diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
index 6b7a55d..263d509 100644
--- a/hosts/demiurge/default.nix
+++ b/hosts/demiurge/default.nix
@@ -63,7 +63,7 @@
   # decrypt agenix secrets
   age.secrets = {
     wg0_demiurge.file = ../../secrets/wg0_demiurge.age;
-    tailscale_demiurge.file = ../../secrets/tailscale_demiurge.age;
+    wg1_demiurge.file = ../../secrets/wg1_demiurge.age;
   };
 
   # boot options
@@ -92,7 +92,7 @@
         9943
         9944
       ];
-      allowedUDPPorts = [ 9943 9944 51413 ];
+      allowedUDPPorts = [ 9943 9944 51413 51820 ];
     };
 
     interfaces.eth0 = {
@@ -109,33 +109,99 @@
     };
 
     # mullvad
-    wg-quick.interfaces.wg0 = {
-      address = [
-        "10.68.117.111/32"
-        "fc00:bbbb:bbbb:bb01::5:756e/128"
-      ];
-      privateKeyFile = config.age.secrets.wg0_demiurge.path;
-
-      # supposed to be done by tailscale instead \_(:/)_/
-      postUp = ''
-        ip route add 100.64.0.0/24 dev tailscale0
-        ip route add 100.100.100.100/32 dev tailscale0
-      '';
-      postDown = ''
-        ip route del 100.64.0.0/24 dev tailscale0
-        ip route del 100.100.100.100/32 dev tailscale0
-      '';
+    wg-quick.interfaces = {
+      wg0 = {
+        address = [
+          "10.68.117.111/32"
+          "fc00:bbbb:bbbb:bb01::5:756e/128"
+        ];
+        privateKeyFile = config.age.secrets.wg0_demiurge.path;
 
-      peers = [
-        {
-          allowedIPs = [
-            "0.0.0.0/0"
-            "::0/0"
-          ];
-          endpoint = "45.134.142.206:51820";
-          publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
-        }
-      ];
+        peers = [
+          {
+            allowedIPs = [
+              "0.0.0.0/0"
+              "::0/0"
+            ];
+            endpoint = "45.134.142.206:51820";
+            publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
+          }
+        ];
+      };
+      wg1 = {
+        address = [
+          "10.0.13.2/24"
+          "fd00:b0ba:cafe:babe::2/64"
+        ];
+        privateKeyFile = config.age.secrets.wg1_demiurge.path;
+        listenPort = 51820;
+        mtu = 1420;
+        table = null;
+        postUp = ''
+# IPv4 NAT
+iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE
+# IPv6 NAT
+ip6tables -t nat -I POSTROUTING 1 -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE
+
+# IPv4 Forwarding Chain
+iptables -N WG1-FWD
+iptables -I FORWARD 1 -j WG1-FWD
+iptables -A WG1-FWD -i wg1 -o wg1 -j ACCEPT
+iptables -A WG1-FWD -i wg1 -o wg0 -j ACCEPT
+iptables -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+# IPv6 Forwarding Chain
+ip6tables -N WG1-FWD
+ip6tables -I FORWARD 1 -j WG1-FWD
+ip6tables -A WG1-FWD -i wg1 -o wg1 -j ACCEPT
+ip6tables -A WG1-FWD -i wg1 -o wg0 -j ACCEPT
+ip6tables -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+        '';
+        preDown = ''
+# IPv4 NAT
+iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE
+# IPv6 NAT
+ip6tables -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE
+
+# IPv4 Forwarding Chain
+iptables -D FORWARD -j WG1-FWD
+iptables -F WG1-FWD
+iptables -X WG1-FWD
+
+# IPv6 Forwarding Chain
+ip6tables -D FORWARD -j WG1-FWD
+ip6tables -F WG1-FWD
+ip6tables -X WG1-FWD
+        '';
+
+        peers = [
+          {
+            # saklas.epistemia
+            publicKey = "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=";
+            endpoint = "157.180.125.215:51820";
+            allowedIPs = [ "10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128" ];
+            persistentKeepalive = 25;
+          }
+          {
+            # hastur.epistemia
+            publicKey = "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=";
+            allowedIPs = [ "10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128" ];
+            persistentKeepalive = 25;
+          }
+          {
+            # iphonebob.epistemia
+            publicKey = "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=";
+            allowedIPs = [ "10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128" ];
+            persistentKeepalive = 25;
+          }
+          {
+            # lab.epistemia
+            publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=";
+            allowedIPs = [ "10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128" ];
+            persistentKeepalive = 25;
+          }
+        ];
+      };
     };
   };
 
@@ -155,13 +221,6 @@
   };
 
   services = {
-    # vpn
-    # TODO replace with wireguard again
-    tailscale = {
-      authKeyFile = config.age.secrets.tailscale_demiurge.path;
-      extraSetFlags = [ "--advertise-exit-node" ];
-    };
-
     # media server
     jellyfin = {
       enable = true;
@@ -275,7 +334,7 @@
     openssh.listenAddresses = [
       { addr = "127.0.0.1"; port = 22; }
       { addr = "192.168.1.2"; port = 22; }
-      { addr = "100.64.0.2"; port = 22; }
+      { addr = "10.0.13.2"; port = 22; }
     ];
 
     # llm
@@ -764,8 +823,5 @@
     };
   };
 
-  # extra systemd stuff
-  systemd.services.nginx.after = [ "tailscaled-autoconnect.service" ];
-
   system.stateVersion = "24.05";
 }