1 files changed, 95 insertions, 39 deletions

diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
index 6b7a55d..263d509 100644
--- a/hosts/demiurge/default.nix
+++ b/hosts/demiurge/default.nix
@@ -63,7 +63,7 @@
   # decrypt agenix secrets
   age.secrets = {
     wg0_demiurge.file = ../../secrets/wg0_demiurge.age;
-    tailscale_demiurge.file = ../../secrets/tailscale_demiurge.age;
+    wg1_demiurge.file = ../../secrets/wg1_demiurge.age;
   };
 
   # boot options
@@ -92,7 +92,7 @@
         9943
         9944
       ];
-      allowedUDPPorts = [ 9943 9944 51413 ];
+      allowedUDPPorts = [ 9943 9944 51413 51820 ];
     };
 
     interfaces.eth0 = {
@@ -109,33 +109,99 @@
     };
 
     # mullvad
-    wg-quick.interfaces.wg0 = {
-      address = [
-        "10.68.117.111/32"
-        "fc00:bbbb:bbbb:bb01::5:756e/128"
-      ];
-      privateKeyFile = config.age.secrets.wg0_demiurge.path;
-
-      # supposed to be done by tailscale instead \_(:/)_/
-      postUp = ''
-        ip route add 100.64.0.0/24 dev tailscale0
-        ip route add 100.100.100.100/32 dev tailscale0
-      '';
-      postDown = ''
-        ip route del 100.64.0.0/24 dev tailscale0
-        ip route del 100.100.100.100/32 dev tailscale0
-      '';
+    wg-quick.interfaces = {
+      wg0 = {
+        address = [
+          "10.68.117.111/32"
+          "fc00:bbbb:bbbb:bb01::5:756e/128"
+        ];
+        privateKeyFile = config.age.secrets.wg0_demiurge.path;
 
-      peers = [
-        {
-          allowedIPs = [
-            "0.0.0.0/0"
-            "::0/0"
-          ];
-          endpoint = "45.134.142.206:51820";
-          publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
-        }
-      ];
+        peers = [
+          {
+            allowedIPs = [
+              "0.0.0.0/0"
+              "::0/0"
+            ];
+            endpoint = "45.134.142.206:51820";
+            publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
+          }
+        ];
+      };
+      wg1 = {
+        address = [
+          "10.0.13.2/24"
+          "fd00:b0ba:cafe:babe::2/64"
+        ];
+        privateKeyFile = config.age.secrets.wg1_demiurge.path;
+        listenPort = 51820;
+        mtu = 1420;
+        table = null;
+        postUp = ''
+# IPv4 NAT
+iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE
+# IPv6 NAT
+ip6tables -t nat -I POSTROUTING 1 -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE
+
+# IPv4 Forwarding Chain
+iptables -N WG1-FWD
+iptables -I FORWARD 1 -j WG1-FWD
+iptables -A WG1-FWD -i wg1 -o wg1 -j ACCEPT
+iptables -A WG1-FWD -i wg1 -o wg0 -j ACCEPT
+iptables -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+# IPv6 Forwarding Chain
+ip6tables -N WG1-FWD
+ip6tables -I FORWARD 1 -j WG1-FWD
+ip6tables -A WG1-FWD -i wg1 -o wg1 -j ACCEPT
+ip6tables -A WG1-FWD -i wg1 -o wg0 -j ACCEPT
+ip6tables -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+        '';
+        preDown = ''
+# IPv4 NAT
+iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE
+# IPv6 NAT
+ip6tables -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE
+
+# IPv4 Forwarding Chain
+iptables -D FORWARD -j WG1-FWD
+iptables -F WG1-FWD
+iptables -X WG1-FWD
+
+# IPv6 Forwarding Chain
+ip6tables -D FORWARD -j WG1-FWD
+ip6tables -F WG1-FWD
+ip6tables -X WG1-FWD
+        '';
+
+        peers = [
+          {
+            # saklas.epistemia
+            publicKey = "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=";
+            endpoint = "157.180.125.215:51820";
+            allowedIPs = [ "10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128" ];
+            persistentKeepalive = 25;
+          }
+          {
+            # hastur.epistemia
+            publicKey = "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc=";
+            allowedIPs = [ "10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128" ];
+            persistentKeepalive = 25;
+          }
+          {
+            # iphonebob.epistemia
+            publicKey = "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=";
+            allowedIPs = [ "10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128" ];
+            persistentKeepalive = 25;
+          }
+          {
+            # lab.epistemia
+            publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=";
+            allowedIPs = [ "10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128" ];
+            persistentKeepalive = 25;
+          }
+        ];
+      };
     };
   };
 
@@ -155,13 +221,6 @@
   };
 
   services = {
-    # vpn
-    # TODO replace with wireguard again
-    tailscale = {
-      authKeyFile = config.age.secrets.tailscale_demiurge.path;
-      extraSetFlags = [ "--advertise-exit-node" ];
-    };
-
     # media server
     jellyfin = {
       enable = true;
@@ -275,7 +334,7 @@
     openssh.listenAddresses = [
       { addr = "127.0.0.1"; port = 22; }
       { addr = "192.168.1.2"; port = 22; }
-      { addr = "100.64.0.2"; port = 22; }
+      { addr = "10.0.13.2"; port = 22; }
     ];
 
     # llm
@@ -764,8 +823,5 @@
     };
   };
 
-  # extra systemd stuff
-  systemd.services.nginx.after = [ "tailscaled-autoconnect.service" ];
-
   system.stateVersion = "24.05";
 }