commit ae8bc969c9efcb800e3476dd49ac484cd8d67d22
parent 29241ed554ab7d9a6a872b32462a38377c094c53
Author: vin <vin@vineetk.net>
Date: Wed, 10 Dec 2025 04:51:10 -0500
remove tailscale
Diffstat:
2 files changed, 106 insertions(+), 50 deletions(-)
diff --git a/flake.lock b/flake.lock
@@ -10,11 +10,11 @@
"systems": "systems"
},
"locked": {
- "lastModified": 1754433428,
- "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
+ "lastModified": 1762618334,
+ "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
"owner": "ryantm",
"repo": "agenix",
- "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
+ "rev": "fcdea223397448d35d9b31f798479227e80183f6",
"type": "github"
},
"original": {
@@ -163,11 +163,11 @@
]
},
"locked": {
- "lastModified": 1759536080,
- "narHash": "sha256-0aXlKPxm2M+F5oywX2TTbY0e6h+tQ+6OYyx7UZn3A4A=",
+ "lastModified": 1765337252,
+ "narHash": "sha256-HuWQp8fM25fyWflbuunQkQI62Hg0ecJxWD52FAgmxqY=",
"owner": "nix-community",
"repo": "home-manager",
- "rev": "edafd6da1936426708f1be0b1a4288007f16639a",
+ "rev": "13cc1efd78b943b98c08d74c9060a5b59bf86921",
"type": "github"
},
"original": {
@@ -184,8 +184,8 @@
]
},
"locked": {
- "lastModified": 1759197167,
- "narHash": "sha256-AwyoFll5dXyxLtipAdfthKSPKaL0nifDEhAKQ8baV1c=",
+ "lastModified": 0,
+ "narHash": "sha256-55vcu6qdgWbK8AczPidx3oZch+2lgxIT0wXT3m69z54=",
"path": "/data/src/clones/llm/llama.cpp",
"type": "path"
},
@@ -211,11 +211,11 @@
},
"nixpkgs": {
"locked": {
- "lastModified": 1759381078,
- "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
+ "lastModified": 1765186076,
+ "narHash": "sha256-hM20uyap1a0M9d344I692r+ik4gTMyj60cQWO+hAYP8=",
"owner": "nixos",
"repo": "nixpkgs",
- "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
+ "rev": "addf7cf5f383a3101ecfba091b98d0a1263dc9b8",
"type": "github"
},
"original": {
diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
@@ -63,7 +63,7 @@
# decrypt agenix secrets
age.secrets = {
wg0_demiurge.file = ../../secrets/wg0_demiurge.age;
- tailscale_demiurge.file = ../../secrets/tailscale_demiurge.age;
+ wg1_demiurge.file = ../../secrets/wg1_demiurge.age;
};
# boot options
@@ -92,7 +92,7 @@
9943
9944
];
- allowedUDPPorts = [ 9943 9944 51413 ];
+ allowedUDPPorts = [ 9943 9944 51413 51820 ];
};
interfaces.eth0 = {
@@ -109,33 +109,99 @@
};
# mullvad
- wg-quick.interfaces.wg0 = {
- address = [
- "10.68.117.111/32"
- "fc00:bbbb:bbbb:bb01::5:756e/128"
- ];
- privateKeyFile = config.age.secrets.wg0_demiurge.path;
-
- # supposed to be done by tailscale instead \_(:/)_/
- postUp = ''
- ip route add 100.64.0.0/24 dev tailscale0
- ip route add 100.100.100.100/32 dev tailscale0
- '';
- postDown = ''
- ip route del 100.64.0.0/24 dev tailscale0
- ip route del 100.100.100.100/32 dev tailscale0
- '';
+ wg-quick.interfaces = {
+ wg0 = {
+ address = [
+ "10.68.117.111/32"
+ "fc00:bbbb:bbbb:bb01::5:756e/128"
+ ];
+ privateKeyFile = config.age.secrets.wg0_demiurge.path;
- peers = [
- {
- allowedIPs = [
- "0.0.0.0/0"
- "::0/0"
- ];
- endpoint = "45.134.142.206:51820";
- publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
- }
- ];
+ peers = [
+ {
+ allowedIPs = [
+ "0.0.0.0/0"
+ "::0/0"
+ ];
+ endpoint = "45.134.142.206:51820";
+ publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
+ }
+ ];
+ };
+ wg1 = {
+ address = [
+ "10.0.13.2/24"
+ "fd00:b0ba:cafe:babe::2/64"
+ ];
+ privateKeyFile = config.age.secrets.wg1_demiurge.path;
+ listenPort = 51820;
+ mtu = 1420;
+ table = null;
+ postUp = ''
+# IPv4 NAT
+iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE
+# IPv6 NAT
+ip6tables -t nat -I POSTROUTING 1 -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE
+
+# IPv4 Forwarding Chain
+iptables -N WG1-FWD
+iptables -I FORWARD 1 -j WG1-FWD
+iptables -A WG1-FWD -i wg1 -o wg1 -j ACCEPT
+iptables -A WG1-FWD -i wg1 -o wg0 -j ACCEPT
+iptables -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+# IPv6 Forwarding Chain
+ip6tables -N WG1-FWD
+ip6tables -I FORWARD 1 -j WG1-FWD
+ip6tables -A WG1-FWD -i wg1 -o wg1 -j ACCEPT
+ip6tables -A WG1-FWD -i wg1 -o wg0 -j ACCEPT
+ip6tables -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+ '';
+ preDown = ''
+# IPv4 NAT
+iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE
+# IPv6 NAT
+ip6tables -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE
+
+# IPv4 Forwarding Chain
+iptables -D FORWARD -j WG1-FWD
+iptables -F WG1-FWD
+iptables -X WG1-FWD
+
+# IPv6 Forwarding Chain
+ip6tables -D FORWARD -j WG1-FWD
+ip6tables -F WG1-FWD
+ip6tables -X WG1-FWD
+ '';
+
+ peers = [
+ {
+ # saklas.epistemia
+ publicKey = "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=";
+ endpoint = "157.180.125.215:51820";
+ allowedIPs = [ "10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128" ];
+ persistentKeepalive = 25;
+ }
+ {
+ # hastur.epistemia
+ publicKey = "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=";
+ allowedIPs = [ "10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128" ];
+ persistentKeepalive = 25;
+ }
+ {
+ # iphonebob.epistemia
+ publicKey = "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=";
+ allowedIPs = [ "10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128" ];
+ persistentKeepalive = 25;
+ }
+ {
+ # lab.epistemia
+ publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=";
+ allowedIPs = [ "10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128" ];
+ persistentKeepalive = 25;
+ }
+ ];
+ };
};
};
@@ -155,13 +221,6 @@
};
services = {
- # vpn
- # TODO replace with wireguard again
- tailscale = {
- authKeyFile = config.age.secrets.tailscale_demiurge.path;
- extraSetFlags = [ "--advertise-exit-node" ];
- };
-
# media server
jellyfin = {
enable = true;
@@ -275,7 +334,7 @@
openssh.listenAddresses = [
{ addr = "127.0.0.1"; port = 22; }
{ addr = "192.168.1.2"; port = 22; }
- { addr = "100.64.0.2"; port = 22; }
+ { addr = "10.0.13.2"; port = 22; }
];
# llm
@@ -764,8 +823,5 @@
};
};
- # extra systemd stuff
- systemd.services.nginx.after = [ "tailscaled-autoconnect.service" ];
-
system.stateVersion = "24.05";
}
