feat(heimdall+desktop): setup wireguard tunnel.

modules/linux/nixos/default.nix

@@ -23,6 +23,7 @@
     ./sunshine.nix
     ./nh.nix
     ./ollama.nix
+    ./secrets.nix
   ];
 
   crony.bluetooth.enable = lib.mkDefault true;

modules/linux/nixos/secrets.nix

@@ -0,0 +1,10 @@
+{
+  age = {
+    secrets = {
+      wg-desktop = {
+        file = ../../../secrets/wg-desktop.age;
+      };
+    };
+    identityPaths = ["/home/crony/.ssh/main"];
+  };
+}

modules/linux/nixos/wireguard.nix

@@ -8,19 +8,10 @@
   };
 
   config = lib.mkIf config.crony.wireguard.enable {
-    # Allow for wireguard traffic
-    networking.firewall = {
-      # if packets are still dropped, they will show up in dmesg
-      logReversePathDrops = true;
-      # wireguard trips rpfilter up
-      extraCommands = ''
-        ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN
-        ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN
-      '';
-      extraStopCommands = ''
-        ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true
-        ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true
-      '';
+    # Setup wireguard
+    networking.wg-quick.interfaces.wg0 = {
+      autostart = false;
+      configFile = "${config.age.secrets.wg-desktop.path}";
     };
   };
 }

modules/servers/heimdall/default.nix

@@ -2,5 +2,7 @@
   imports = [
     ./uptime-kuma.nix
     ./ntfy-sh.nix
+    ./wireguard.nix
+    ./secrets.nix
   ];
 }

modules/servers/heimdall/secrets.nix

@@ -0,0 +1,9 @@
+{
+  age = {
+    secrets = {
+      wg-heimdall = {
+        file = ../../../secrets/wg-heimdall.age;
+      };
+    };
+  };
+}

modules/servers/heimdall/wireguard.nix

@@ -0,0 +1,24 @@
+{config, ...}: {
+  networking = {
+    nat = {
+      enable = true;
+      enableIPv6 = true;
+      externalInterface = "enp1s0";
+      internalInterfaces = ["wg0"];
+    };
+    firewall = {
+      allowedTCPPorts = [53];
+      allowedUDPPorts = [53 51820];
+    };
+    wg-quick.interfaces.wg0.configFile = "${config.age.secrets.wg-heimdall.path}";
+  };
+
+  services.dnsmasq = {
+    enable = true;
+    settings = {
+      interface = "wg0";
+    };
+  };
+
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+}