From ae8bc969c9efcb800e3476dd49ac484cd8d67d22 Mon Sep 17 00:00:00 2001 From: vin Date: Wed, 10 Dec 2025 04:51:10 -0500 Subject: remove tailscale --- flake.lock | 22 ++++---- hosts/demiurge/default.nix | 134 ++++++++++++++++++++++++++++++++------------- 2 files changed, 106 insertions(+), 50 deletions(-) diff --git a/flake.lock b/flake.lock index ff49e7e..648b7d4 100644 --- a/flake.lock +++ b/flake.lock @@ -10,11 +10,11 @@ "systems": "systems" }, "locked": { - "lastModified": 1754433428, - "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=", + "lastModified": 1762618334, + "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=", "owner": "ryantm", "repo": "agenix", - "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d", + "rev": "fcdea223397448d35d9b31f798479227e80183f6", "type": "github" }, "original": { @@ -163,11 +163,11 @@ ] }, "locked": { - "lastModified": 1759536080, - "narHash": "sha256-0aXlKPxm2M+F5oywX2TTbY0e6h+tQ+6OYyx7UZn3A4A=", + "lastModified": 1765337252, + "narHash": "sha256-HuWQp8fM25fyWflbuunQkQI62Hg0ecJxWD52FAgmxqY=", "owner": "nix-community", "repo": "home-manager", - "rev": "edafd6da1936426708f1be0b1a4288007f16639a", + "rev": "13cc1efd78b943b98c08d74c9060a5b59bf86921", "type": "github" }, "original": { @@ -184,8 +184,8 @@ ] }, "locked": { - "lastModified": 1759197167, - "narHash": "sha256-AwyoFll5dXyxLtipAdfthKSPKaL0nifDEhAKQ8baV1c=", + "lastModified": 0, + "narHash": "sha256-55vcu6qdgWbK8AczPidx3oZch+2lgxIT0wXT3m69z54=", "path": "/data/src/clones/llm/llama.cpp", "type": "path" }, @@ -211,11 +211,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1759381078, - "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=", + "lastModified": 1765186076, + "narHash": "sha256-hM20uyap1a0M9d344I692r+ik4gTMyj60cQWO+hAYP8=", "owner": "nixos", "repo": "nixpkgs", - "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee", + "rev": "addf7cf5f383a3101ecfba091b98d0a1263dc9b8", "type": "github" }, "original": { diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix index 6b7a55d..263d509 100644 --- a/hosts/demiurge/default.nix +++ b/hosts/demiurge/default.nix @@ -63,7 +63,7 @@ # decrypt agenix secrets age.secrets = { wg0_demiurge.file = ../../secrets/wg0_demiurge.age; - tailscale_demiurge.file = ../../secrets/tailscale_demiurge.age; + wg1_demiurge.file = ../../secrets/wg1_demiurge.age; }; # boot options @@ -92,7 +92,7 @@ 9943 9944 ]; - allowedUDPPorts = [ 9943 9944 51413 ]; + allowedUDPPorts = [ 9943 9944 51413 51820 ]; }; interfaces.eth0 = { @@ -109,33 +109,99 @@ }; # mullvad - wg-quick.interfaces.wg0 = { - address = [ - "10.68.117.111/32" - "fc00:bbbb:bbbb:bb01::5:756e/128" - ]; - privateKeyFile = config.age.secrets.wg0_demiurge.path; - - # supposed to be done by tailscale instead \_(:/)_/ - postUp = '' - ip route add 100.64.0.0/24 dev tailscale0 - ip route add 100.100.100.100/32 dev tailscale0 - ''; - postDown = '' - ip route del 100.64.0.0/24 dev tailscale0 - ip route del 100.100.100.100/32 dev tailscale0 - ''; + wg-quick.interfaces = { + wg0 = { + address = [ + "10.68.117.111/32" + "fc00:bbbb:bbbb:bb01::5:756e/128" + ]; + privateKeyFile = config.age.secrets.wg0_demiurge.path; - peers = [ - { - allowedIPs = [ - "0.0.0.0/0" - "::0/0" - ]; - endpoint = "45.134.142.206:51820"; - publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw="; - } - ]; + peers = [ + { + allowedIPs = [ + "0.0.0.0/0" + "::0/0" + ]; + endpoint = "45.134.142.206:51820"; + publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw="; + } + ]; + }; + wg1 = { + address = [ + "10.0.13.2/24" + "fd00:b0ba:cafe:babe::2/64" + ]; + privateKeyFile = config.age.secrets.wg1_demiurge.path; + listenPort = 51820; + mtu = 1420; + table = null; + postUp = '' +# IPv4 NAT +iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE +# IPv6 NAT +ip6tables -t nat -I POSTROUTING 1 -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE + +# IPv4 Forwarding Chain +iptables -N WG1-FWD +iptables -I FORWARD 1 -j WG1-FWD +iptables -A WG1-FWD -i wg1 -o wg1 -j ACCEPT +iptables -A WG1-FWD -i wg1 -o wg0 -j ACCEPT +iptables -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + +# IPv6 Forwarding Chain +ip6tables -N WG1-FWD +ip6tables -I FORWARD 1 -j WG1-FWD +ip6tables -A WG1-FWD -i wg1 -o wg1 -j ACCEPT +ip6tables -A WG1-FWD -i wg1 -o wg0 -j ACCEPT +ip6tables -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + ''; + preDown = '' +# IPv4 NAT +iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE +# IPv6 NAT +ip6tables -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE + +# IPv4 Forwarding Chain +iptables -D FORWARD -j WG1-FWD +iptables -F WG1-FWD +iptables -X WG1-FWD + +# IPv6 Forwarding Chain +ip6tables -D FORWARD -j WG1-FWD +ip6tables -F WG1-FWD +ip6tables -X WG1-FWD + ''; + + peers = [ + { + # saklas.epistemia + publicKey = "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0="; + endpoint = "157.180.125.215:51820"; + allowedIPs = [ "10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128" ]; + persistentKeepalive = 25; + } + { + # hastur.epistemia + publicKey = "1ketYziRhoUmpbrj/60O5DYbcPacvmEoFQqa/NntSnc="; + allowedIPs = [ "10.0.13.3/32" "fd00:b0ba:cafe:babe::3/128" ]; + persistentKeepalive = 25; + } + { + # iphonebob.epistemia + publicKey = "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30="; + allowedIPs = [ "10.0.13.4/32" "fd00:b0ba:cafe:babe::4/128" ]; + persistentKeepalive = 25; + } + { + # lab.epistemia + publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE="; + allowedIPs = [ "10.0.13.5/32" "fd00:b0ba:cafe:babe::5/128" ]; + persistentKeepalive = 25; + } + ]; + }; }; }; @@ -155,13 +221,6 @@ }; services = { - # vpn - # TODO replace with wireguard again - tailscale = { - authKeyFile = config.age.secrets.tailscale_demiurge.path; - extraSetFlags = [ "--advertise-exit-node" ]; - }; - # media server jellyfin = { enable = true; @@ -275,7 +334,7 @@ openssh.listenAddresses = [ { addr = "127.0.0.1"; port = 22; } { addr = "192.168.1.2"; port = 22; } - { addr = "100.64.0.2"; port = 22; } + { addr = "10.0.13.2"; port = 22; } ]; # llm @@ -764,8 +823,5 @@ }; }; - # extra systemd stuff - systemd.services.nginx.after = [ "tailscaled-autoconnect.service" ]; - system.stateVersion = "24.05"; } -- cgit v1.2.3