From 6384bec28fdfee01797cfb3e2d13d27b59e3da3b Mon Sep 17 00:00:00 2001
From: vin <vin@vineetk.net>
Date: Sun, 21 Sep 2025 14:23:48 -0400
Subject: begrudgingly go back to tailscale

---
 hosts/demiurge/default.nix | 69 +++++++++++++++++++++-------------------------
 1 file changed, 32 insertions(+), 37 deletions(-)

diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
index 9c781ca..9f35926 100644
--- a/hosts/demiurge/default.nix
+++ b/hosts/demiurge/default.nix
@@ -121,21 +121,22 @@
     };
 
     # mullvad
-    wireguard.interfaces.wg0 = {
-      ips = [
+    wg-quick.interfaces.wg0 = {
+      address = [
         "10.68.117.111/32"
         "fc00:bbbb:bbbb:bb01::5:756e/128"
       ];
       privateKeyFile = config.age.secrets.wg0_demiurge.path;
 
-      postSetup = ''
-        		ip route add 45.134.142.206 via 192.168.1.1
-        		ip route add default via 45.134.142.206
-        	'';
-      postShutdown = ''
-        		ip route del default via 45.134.142.206
-        		ip route del 45.134.142.206 via 192.168.1.1
-        	'';
+      # supposed to be done by tailscale instead \_(:/)_/
+      postUp = ''
+        ip route add 100.64.0.0/24 dev tailscale0
+        ip route add 100.100.100.100/32 dev tailscale0
+      '';
+      postDown = ''
+        ip route del 100.64.0.0/24 dev tailscale0
+        ip route del 100.100.100.100/32 dev tailscale0
+      '';
 
       peers = [
         {
@@ -253,12 +254,12 @@
   services = {
     # dns
     unbound = {
-      enable = false;
+      enable = true;
       settings = {
         server = {
           interface = [
             "127.0.0.1"
-            "10.0.13.2"
+            "100.64.0.2"
             "fd00:b0ba:cafe:babe::2"
             "::1"
           ];
@@ -273,6 +274,24 @@
           # Synthesize NXDOMAINs from DNSSEC NSEC chains.
           # https://tools.ietf.org/html/rfc8198
           aggressive-nsec = false;
+
+          module-config = "\"respip validator iterator\"";
+
+          local-data = [
+            "\"saklas.epistemia. 86400 IN A 100.64.0.1\""
+            "\"demiurge.epistemia. 86400 IN A 100.64.0.2\""
+            "\"hastur.epistemia. 86400 IN A 100.64.0.3\""
+            "\"iphonebob.epistemia. 86400 IN A 100.64.0.4\""
+            "\"lab.epistemia. 86400 IN A 100.64.0.5\""
+          ];
+
+          local-zone = [
+            "\"saklas.epistemia.\" redirect"
+            "\"demiurge.epistemia.\" redirect"
+            "\"hastur.epistemia.\" redirect"
+            "\"iphonebob.epistemia.\" redirect"
+            "\"lab.epistemia.\" redirect"
+          ];
         };
 
         # hagezi for dns-based adblocking (in addition to others)
@@ -285,32 +304,8 @@
         # go through mullvad for regular dns queries
         forward-zone = {
           name = ".";
-          forward-addr = [ "100.64.0.3" ];
+          forward-addr = [ "194.242.2.2" ];
         };
-
-        local-data = [
-          "demiurge.epistemia. 86400 IN A 10.0.13.2"
-          "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2"
-          "hastur.epistemia. 86400 IN A 10.0.13.3"
-          "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3"
-          "iphonebob.epistemia. 86400 IN A 10.0.13.4"
-          "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4"
-          "lab.epistemia. 86400 IN A 10.0.13.5"
-          "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5"
-          "paraclete.epistemia. 86400 IN A 10.0.13.6"
-          "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6"
-          "saklas.epistemia. 86400 IN A 10.0.13.1"
-          "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1"
-        ];
-
-        local-zone = [
-          "\"demiurge.epistemia.\" redirect"
-          "\"hastur.epistemia.\" redirect"
-          "\"iphonebob.epistemia.\" redirect"
-          "\"lab.epistemia.\" redirect"
-          "\"paraclete.epistemia.\" redirect"
-          "\"saklas.epistemia.\" redirect"
-        ];
       };
     };
 
-- 
cgit v1.2.3