system/wireguard: bring back, with ipv6 support

hosts/dandelion/default.nix

@@ -16,6 +16,7 @@
     nix-stable
     packages
     security
+    wireguard
 
     modules.services.nginx
     modules.services.postgres

modules/system/wireguard.nix

@@ -1,14 +1,12 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, gcSecrets, ... }:
 let
   port = 51820;
-  serverName = "sugarcane";
-  serverInterface = "ens3";
-  serverIp = "51.79.240.130";
+  serverName = "dandelion";
+  serverInterface = "enp0s6";
+  serverIp = gcSecrets.wireguard.gateway;
 
   forwarding = {
-    "80" = [ "10.100.0.2" "80" ];
-    "443" = [ "10.100.0.2" "443" ];
-    "22727" = [ "10.100.0.3" "7777" ];
+#    "22727" = [ "10.100.0.3" "7777" ];
   };
 
   mapForwards = type:
@@ -24,45 +22,39 @@ let
     );
 
   routeBypass = {
-    caramel = {
-      gateway = "192.168.100.1";
-      interface = "wlan0";
-      routes = [
-        serverIp
-      ];
+    anemone = {
+      interface = "wlp1s0";
+      routes = [ serverIp ];
     };
     hyacinth = {
-      gateway = "192.168.100.1";
       interface = "enp5s0";
-      routes = [
-        serverIp
-      ];
+      routes = [ serverIp ];
     };
   };
 
   clients = {
-    caramel = {
-      publicKey = "VDqcpS0lJzFgwikj61MJ1xc9P8Cuq0NXa+Hc+etn2iA=";
-      allowedIPs = [ "10.100.0.2/32" ];
-    };
+    # caramel = {
+    #   publicKey = "VDqcpS0lJzFgwikj61MJ1xc9P8Cuq0NXa+Hc+etn2iA=";
+    #   allowedIPs = [ "10.100.0.2/32" ];
+    # };
     hyacinth = {
       publicKey = "6nVhazYdmC15A/nke9VrqIg3sOBVOmqj4GEsyBq7MVo=";
-      allowedIPs = [ "10.100.0.3/32" ];
+      allowedIPs = [ "10.100.0.3/32" "${gcSecrets.wireguard.ipv6Subnet}:3"];
     };
-    strawberry = {
+    anemone = {
       publicKey = "Fkcp/VSN4Dkhly8V4hskF4lnDviA7VZHCnWf7OliFCg=";
-      allowedIPs = [ "10.100.0.4/32" ];
+      allowedIPs = [ "10.100.0.4/32" "${gcSecrets.wireguard.ipv6Subnet}:4" ];
     };
-    maple = {
-      publicKey = "kPw8hpANygfz83Oi/l+iCVYalV2zfs7fhkccjoGG2Do=";
-      allowedIPs = [ "10.100.0.5/32" ];
+    hibiscus = {
+      publicKey = "vQ5a2KMrwi7RCRsD0yvog+n35vQYFuvwiPn+W4lbRBw=";
+      allowedIPs = [ "10.100.0.5/32" "${gcSecrets.wireguard.ipv6Subnet}:5" ];
     };
   };
 
   clientPeers = builtins.attrValues clients;
   serverPeer = {
     publicKey = "3ugIk2tQZXjAH9/95s63ld2WNUHQrd4Mz5jzbln6oj0=";
-    allowedIPs = [ "0.0.0.0/0" ];
+    allowedIPs = [ "0.0.0.0/0" "::/0" ];
     endpoint = "${serverIp}:${toString port}";
     persistentKeepalive = 25;
   };
@@ -79,7 +71,7 @@ let
     };
 
     wireguard.interfaces.wg0 = {
-      ips = [ "10.100.0.1/24" ];
+      ips = [ "10.100.0.1/24" "${gcSecrets.wireguard.ipv6Subnet}:1" ];
       listenPort = port;
 
       postSetup = ''
@@ -101,7 +93,7 @@ let
     let
       client = clients."${config.networking.hostName}";
       routes = routeBypass."${config.networking.hostName}";
-      mapRoutes = type: lib.concatMapStringsSep "\n" (r: "${pkgs.iproute2}/bin/ip route ${type} ${r} via ${routes.gateway} dev ${routes.interface}") routes.routes;
+      mapRoutes = type: lib.concatMapStringsSep "\n" (r: "${pkgs.iproute2}/bin/ip route ${type} ${r} dev ${routes.interface}") routes.routes;
     in {
       ips = client.allowedIPs;
       listenPort = port;
@@ -121,6 +113,10 @@ let
     };
   };
 in {
+  boot.kernel.sysctl = lib.mkIf (config.networking.hostName == serverName) ({
+    "net.ipv6.conf.all.forwarding" = true;
+    "net.ipv6.conf.default.forwarding" = true;
+  });
   networking =
     lib.mkMerge [
       (lib.mkIf (config.networking.hostName == serverName) serverConfig)

secrets.nix

@@ -11,7 +11,8 @@ in {
 
   "secrets/acme_dns.age".publicKeys = [ dandelion hazel rin ];
   "secrets/warden_admin.age".publicKeys = [ rin ];
-  "secrets/wg_blossom.age".publicKeys = [ blossom rin ];
+  "secrets/wg_anemone.age".publicKeys = [ anemone rin ];
+  "secrets/wg_dandelion.age".publicKeys = [ dandelion rin ];
+  "secrets/wg_hyacinth.age".publicKeys = [ blossom rin ];
   "secrets/wg_caramel.age".publicKeys = [ rin ];
-  "secrets/wg_sugarcane.age".publicKeys = [ rin ];
 }

secrets/wg_blossom.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 CUCjXQ hLTFE9rxZfhOZ2rELykmG54pxJMCjTkzBvLasvgSN24
-wDbW0X7bItmMEDfGRVAw+wHycHDI/2OYAb5jFyd8f6s
--> ssh-ed25519 U9FXlg juuKBMw9hX559zK6f2ERuBMl27ypQ6Ky5xlFEJxApXc
-Gb6/rTwqMINqiojoIWcFEAQCEuQ6bQQHrOXChkthb4A
---- OEQ8ALTXcJKvpf0rJe6x2VHSAsTi1yFhz3eU0CZDjqE
-<EFBFBD><EFBFBD><EFBFBD>ٓP<EFBFBD><EFBFBD>Θ~<7E>F<EFBFBD><46>d<EFBFBD>wi
 <20>]h<><68><EFBFBD><EFBFBD>//<2F><03>4<>ڰ<EFBFBD>N<EFBFBD><4E>7L<14><><EFBFBD>aQ=	<19>v@<40>oB<6F><42><EFBFBD><EFBFBD>*<2A>48 D=<3D>򪋅

secrets/wg_caramel.age

@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 U9FXlg qEy0vaHPPr9EUDjC3FveSk/xcnW/rtHVmx9o7cH7JFA
-WAzEfa7T82vbkwMv/JIOASIjZ3gr1TRNfVzOWdWBVkQ
---- AoVNbcEOrFU5jcQ8geP5e4Lo3RxOyP9p4BG3BNsgiIQ
-ÛÙ³Î'ºäÔXoüY÷ûÀfůŠ!Ãúá¡Êû/
Ù"p;<BZƒT{&luŸëíõ3³bõÃRÓ“rHï™­tä\ü½söÕòÁ´·
+-> ssh-ed25519 U9FXlg VpFnvpTVZFSkKRpEgcmuT/WDLIP1ZySFLq2lRvrjq20
+7zQoSoIs1URmAYn2AdjvDTIY8GDYROcSxFq1bcl24Og
+--- iaQQUE1/Xj1vxto3d+Llyl6XGrSff5MGPxdCHW9EI40
+»ò”ùßƦÅ`t‘Á	¶\š ó
+b<EFBFBD>žpeHøžºXÚ3à!‹$ë3]Xý32Öt~Ví.=Íâ>é$òxÞB×KJ¨AL:¢DDâ}5

secrets/wg_dandelion.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 bRFqeQ swv/p+w9+aytIkQ/6Yk1jouA+0M3rJabuiOz2rlpyAs
+wt+wnM1EEKAyDNefr9K4+DtZvHcOzz9Y1EBRFkA5Nv4
+-> ssh-ed25519 U9FXlg xxV/8JoorO4YWPbwSG7p306Pb2+aT10u9eNR69PhZAA
+rjOOuapa/h1tMYbdOc3Y/fPPzkNcYiamSk6rS/tbhtE
+--- UKvt/4aAyYHOk5bhAP55yxPhkxTE94/xEqIqpGF3yiE
+ŠãÞÕ5;_±E<C2B1>DBé<kÔJ~‹<>&ªTD›¤z`/=t¯½É²¨؈°ºéÒ;<07>yà)°ì%’LÙ•J*@£Ì
cx<;ñ¹ko˜ˆ

secrets/wg_hyacinth.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 CUCjXQ ptHKlNvz+AmnB/Wt9XBBNyfOGeoPG5TbyrXv5993PDQ
+P0C17K+Kz8ocn0vzLf02aaYnxvRM/yjfRLMsBaJhsok
+-> ssh-ed25519 U9FXlg /M8ryJjXAdlWhvNHbQgKUxe/UtL7HqEs9RqNDQBW3SM
+p2d9OnOkU2Hx7+Kn+Z66qElFvczd3F4zVm5KXbOzYWY
+--- PVd8mrRk/t6qv/U32/AZk9YssRU1yn3CLPeyaEPBXi0
+Ôíš:ÙDx[cyyÛ™c4×É¥À/Þ‡^›.¼·=÷†‹È¯oöG›VQdXf<>©ò^È@TRe<52>Åæˆgœ½<C593>nøÀÆÖ9UTØ	

secrets/wg_sugarcane.age

@@ -1,5 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 U9FXlg 7YXsTcRa8pco9Ic9fDSygCjNXrxFi5pHADtUqwOBPhg
-0BYvRAhcQQ36kAXOW2QaS4S9rhenUx8xwbNozNdDpLM
---- V1E/2n1Ae5hlWhjAEziHA2J072a20GeKM+EtG+pT8cI
-ÿúº÷ºçª´zW‰„ôTþŠì¢¾¢G³{ݨ¢"’Þ\Ê–s<E28093>ËâeÜ>®…æÈúîü¦%õÌ)o|z™!Ä“©×–2ࢨE¢sÐ