1 files changed, 26 insertions, 24 deletions

diff --git a/hosts/surtr/vpn/default.nix b/hosts/surtr/vpn/default.nix
index 636dab1a..3f7483bd 100644
--- a/hosts/surtr/vpn/default.nix
+++ b/hosts/surtr/vpn/default.nix
@@ -15,18 +15,22 @@ in {
     containers."vpn" = {
       autoStart = true;
       ephemeral = true;
+      additionalCapabilities = [
+        "CAP_SYS_TTY_CONFIG" "CAP_NET_ADMIN" "CAP_NET_RAW" "CAP_SYS_ADMIN"
+      ];
       extraFlags = [
+        "--load-credential=surtr.priv:/run/credentials/container@vpn.service/surtr.priv"
         "--network-ipvlan=ens3:upstream"
-        "--load-credential=surtr.priv:${config.sops.secrets.vpn.path}"
       ];
-
       config = {
         boot.kernel.sysctl = {
           "net.core.rmem_max" = 4194304;
           "net.core.wmem_max" = 4194304;
+
           "net.ipv6.conf.all.forwarding" = 1;
-          "net.ipv6.conf.default.forwarding"= 1;
+          "net.ipv6.conf.default.forwarding" = 1;
           "net.ipv4.conf.all.forwarding" = 1;
+          "net.ipv4.conf.default.forwarding" = 1;
         };
 
         environment = {
@@ -81,10 +85,8 @@ in {
                 ListenPort = 51820;
               };
               wireguardPeers = imap1 (i: { name, ip ? i }: {
-                wireguardPeerConfig = {
-                  AllowedIPs = ["${prefix6}:${toString ip}::/96" "${prefix4}.${toString ip}/32"];
-                  PublicKey = trim (readFile (./. + "/${name}.pub"));
-                };
+                AllowedIPs = ["${prefix6}:${toString ip}::/96" "${prefix4}.${toString ip}/32"];
+                PublicKey = trim (readFile (./. + "/${name}.pub"));
               }) [ { name = "geri"; } { name = "sif"; } ];
             };
           };
@@ -104,19 +106,13 @@ in {
                 MulticastDNS = false;
               };
               routes = [
-                { routeConfig = {
-                    Destination = "202.61.240.1";
-                  };
+                { Destination = "202.61.240.1";
                 }
-                { routeConfig = {
-                    Destination = "0.0.0.0/0";
-                    Gateway = "202.61.240.1";
-                  };
+                { Destination = "0.0.0.0/0";
+                  Gateway = "202.61.240.1";
                 }
-                { routeConfig = {
-                    Destination = "::/0";
-                    Gateway = "fe80::1";
-                  };
+                { Destination = "::/0";
+                  Gateway = "fe80::1";
                 }
               ];
               extraConfig = ''
@@ -132,13 +128,9 @@ in {
               };
               address = ["${prefix6}::/96" "${prefix4}.0/32"];
               routes = [
-                { routeConfig = {
-                    Destination = "${prefix6}::/80";
-                  };
+                { Destination = "${prefix6}::/80";
                 }
-                { routeConfig = {
-                    Destination = "${prefix4}.0/24";
-                  };
+                { Destination = "${prefix4}.0/24";
                 }
               ];
               linkConfig = {
@@ -154,6 +146,16 @@ in {
       };
     };
 
+    systemd.services = {
+      "container@vpn" = {
+        serviceConfig = {
+          LoadCredential = [
+            "surtr.priv:${config.sops.secrets.vpn.path}"
+          ];
+        };
+      };
+    };
+
     sops.secrets.vpn = {
       format = "binary";
       sopsFile = ./surtr.priv;