feat(heimdall+desktop): setup wireguard tunnel.

flake.nix

@@ -175,6 +175,7 @@
           ./modules/linux/nixos
           # Still no specific modules here
           # ./modules/cross-platform/nixos
+          agenix.nixosModules.default
           # Setup home manager for my user
           home-manager.nixosModules.home-manager
           {

modules/linux/nixos/default.nix

@@ -23,6 +23,7 @@
     ./sunshine.nix
     ./nh.nix
     ./ollama.nix
+    ./secrets.nix
   ];
 
   crony.bluetooth.enable = lib.mkDefault true;

modules/linux/nixos/secrets.nix

@@ -0,0 +1,10 @@
+{
+  age = {
+    secrets = {
+      wg-desktop = {
+        file = ../../../secrets/wg-desktop.age;
+      };
+    };
+    identityPaths = ["/home/crony/.ssh/main"];
+  };
+}

modules/linux/nixos/wireguard.nix

@@ -8,19 +8,10 @@
   };
 
   config = lib.mkIf config.crony.wireguard.enable {
-    # Allow for wireguard traffic
-    networking.firewall = {
-      # if packets are still dropped, they will show up in dmesg
-      logReversePathDrops = true;
-      # wireguard trips rpfilter up
-      extraCommands = ''
-        ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN
-        ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN
-      '';
-      extraStopCommands = ''
-        ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true
-        ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true
-      '';
+    # Setup wireguard
+    networking.wg-quick.interfaces.wg0 = {
+      autostart = false;
+      configFile = "${config.age.secrets.wg-desktop.path}";
     };
   };
 }

modules/servers/heimdall/default.nix

@@ -2,5 +2,7 @@
   imports = [
     ./uptime-kuma.nix
     ./ntfy-sh.nix
+    ./wireguard.nix
+    ./secrets.nix
   ];
 }

modules/servers/heimdall/secrets.nix

@@ -0,0 +1,9 @@
+{
+  age = {
+    secrets = {
+      wg-heimdall = {
+        file = ../../../secrets/wg-heimdall.age;
+      };
+    };
+  };
+}

modules/servers/heimdall/wireguard.nix

@@ -0,0 +1,24 @@
+{config, ...}: {
+  networking = {
+    nat = {
+      enable = true;
+      enableIPv6 = true;
+      externalInterface = "enp1s0";
+      internalInterfaces = ["wg0"];
+    };
+    firewall = {
+      allowedTCPPorts = [53];
+      allowedUDPPorts = [53 51820];
+    };
+    wg-quick.interfaces.wg0.configFile = "${config.age.secrets.wg-heimdall.path}";
+  };
+
+  services.dnsmasq = {
+    enable = true;
+    settings = {
+      interface = "wg0";
+    };
+  };
+
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+}

secrets/secrets.nix

@@ -11,4 +11,6 @@ let
   systems = [heimdall];
 in {
   "traefik.age".publicKeys = systems ++ users;
+  "wg-heimdall.age".publicKeys = systems ++ users;
+  "wg-desktop.age".publicKeys = systems ++ users;
 }

secrets/wg-desktop.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 2P4nKw PmQyF+dwOGsxBl9Cb8fPAF2szc58PxBDQYQHQHjj3To
+4JC0/xuiU+hQRw2JP7F/AbQR7ewNygTIcYDr99kRRsI
+-> ssh-ed25519 fd/ZLQ xzfSyCwim1CDwS+EipluJsp6PFQap5CAAVqcFjcmq2w
+1v6DZMND3RUx8bYLNegFCulI6t6YJWc7R140o5YuJNw
+--- gT2MyDArAIxv/DbiaPNesbtHjBROCp55KtVX1cQfUNQ
+
ʆ²‰¶ü`%~}^÷PœŠdbÃZ´Ésõ
&iŸ¦þ3‡”.ø
QÇ”sêct5?,[ 1PRq€‘»¼0ü,Wgay„HJîºèbÏð…ttÓàÚezT
lÁc6ç²Àðê
Ï®ÍÇ´øzÓ(iá°íQ8ð‘ç> 3õ9“ÝP/sK‡Ã>¡í„ÑIί‘h‘Ri³£J½¡|d#O<7ÎNšÓãå!ÀÛß]+gÁ­:¢¸»O¡zü
m8 Õï’ÀˆK¿F‰ì‹ïªLv-Às¿f%-ëgòzàÿ'ÆÖ“7H>c³
+%®ràК¶õDœK!©ü×Fçy‰ÿ<E280B0>!e{ðô—Zi0T½^f0tqƒWlI.6æ´¤²B;
+#9^ÿbJˆõDa¿=!úˆ¹æ…+Ânoö!æ˜
+®1 ”Õ\°Á‡1ëK#+a4}&ièñ=—'QÆñ®pÅŒp²o'¢2ËP.ÉàïÒ\67|f4Ͷ—<C2B6>/€~Ì…$µ?…&Câ?Ký§