3 files changed, 46 insertions, 15 deletions

diff --git a/hosts/hastur/default.nix b/hosts/hastur/default.nix
index 8738af4..b808e06 100644
--- a/hosts/hastur/default.nix
+++ b/hosts/hastur/default.nix
@@ -11,6 +11,15 @@
       home-manager.nixosModules.default
     ];
 
+  # decrypt agenix secrets
+  age.secrets = {
+    tailscale_hastur = {
+      file = ../../secrets/tailscale_hastur.age;
+      owner = "root";
+      group = "root";
+    };
+  };
+
   # boot options
   boot.loader.grub = {
     enable = true;
@@ -58,22 +67,29 @@
       #      allowedUDPPorts = [ ];
     };
 
-    wg-quick.interfaces = {
-      # mullvad to miami
-      us-mia-wg-001 = {
-        address = [
-          "10.70.235.16/32"
-          "fc00:bbbb:bbbb:bb01::7:eb0f/128"
-        ];
-
-        peers = [{
-          allowedIPs = [ "0.0.0.0/0" "::0/0" ];
-          endpoint = "45.134.142.219:51820";
-          publicKey = "FVEKAMJqaJU2AwWn5Mg9TK9IAfJc4XDUmSzEeC/VXGs=";
-        }];
+    # mullvad to miami
+    wg-quick.interfaces.us-mia-wg-001 = {
+      address = [
+        "10.70.235.16/32"
+        "fc00:bbbb:bbbb:bb01::7:eb0f/128"
+      ];
+      privateKey = "***REDACTED_WG_KEY***=";
+
+      # supposed to be done by tailscale instead \_(:/)_/
+      postUp = ''
+        ip route add 100.64.0.0/24 dev tailscale0
+        ip route add 100.100.100.100/32 dev tailscale0
+      '';
+      postDown = ''
+        ip route del 100.64.0.0/24 dev tailscale0
+        ip route del 100.100.100.100/32 dev tailscale0
+      '';
 
-        privateKey = "***REDACTED_WG_KEY***=";
-      };
+      peers = [{
+        allowedIPs = [ "0.0.0.0/0" "::0/0" ];
+        endpoint = "45.134.142.219:51820";
+        publicKey = "FVEKAMJqaJU2AwWn5Mg9TK9IAfJc4XDUmSzEeC/VXGs=";
+      }];
     };
   };
 
@@ -238,6 +254,18 @@ LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
       pulse.enable = true;
     };
 
+    # vpn
+    tailscale = {
+      enable = true;
+      authKeyFile = config.age.secrets.tailscale_hastur.path;
+      extraDaemonFlags = [ "--no-logs-no-support" ];
+      extraUpFlags = [
+        "--login-server=https://headscale.13f0.net"
+        "--advertise-exit-node"
+      ];
+      openFirewall = true;
+    };
+
     # enable better power management
     tlp.enable = true;
 
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index e42d9d5..801c352 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -3,6 +3,7 @@ let
   users = [ vin ];
 
   demiurge = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICXDBcX7hXJCaKDRNaIAfycU83Y2J+uEB4wcALBOQpse";
+  hastur = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2ZUuPSPpIRULzMscBo5DJmA0UbFtG0jaANuzHo5aSQ";
   saklas = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM7RCmfdgJKPnaBi336ZcvDWboxPj8lTtW1eDTN5qR2R";
   systems = [ demiurge saklas ];
 in
@@ -13,6 +14,8 @@ in
 
   "hetzner_dns.age".publicKeys = users ++ [ saklas ];
   "radicale_users.age".publicKeys = users ++ [ saklas ];
+
   "tailscale_demiurge.age".publicKeys = users ++ [ demiurge ];
+  "tailscale_hastur.age".publicKeys = users ++ [ hastur ];
   "tailscale_saklas.age".publicKeys = users ++ [ saklas ];
 }
diff --git a/secrets/tailscale_hastur.age b/secrets/tailscale_hastur.age
new file mode 100644
index 0000000..167826a
--- /dev/null
+++ b/secrets/tailscale_hastur.age