{ pkgs, config, lib, ... }: with lib; let trim = str: if hasSuffix "\n" str then trim (removeSuffix "\n" str) else str; prefix4 = "10.84.47"; prefix6 = "2a03:4000:52:ada:5"; in { config = { boot.kernel.sysctl = { "net.netfilter.nf_log_all_netns" = true; }; containers."vpn" = { autoStart = true; ephemeral = true; additionalCapabilities = [ "CAP_SYS_TTY_CONFIG" "CAP_NET_ADMIN" "CAP_NET_RAW" "CAP_SYS_ADMIN" ]; extraFlags = [ "--load-credential=surtr.priv:/run/credentials/container@vpn.service/surtr.priv" "--network-ipvlan=ens3:upstream" ]; config = { boot.kernel.sysctl = { "net.core.rmem_max" = 4194304; "net.core.wmem_max" = 4194304; "net.ipv6.conf.all.forwarding" = 1; "net.ipv6.conf.default.forwarding" = 1; "net.ipv4.conf.all.forwarding" = 1; "net.ipv4.conf.default.forwarding" = 1; }; environment = { noXlibs = true; systemPackages = with pkgs; [ wireguard-tools ]; }; networking = { useDHCP = false; useNetworkd = true; useHostResolvConf = false; firewall.enable = false; nftables = { enable = true; rulesetFile = ./ruleset.nft; }; }; services.resolved.fallbackDns = [ "9.9.9.10#dns10.quad9.net" "149.112.112.10#dns10.quad9.net" "2620:fe::10#dns10.quad9.net" "2620:fe::fe:10#dns10.quad9.net" ]; systemd.services."systemd-networkd" = { serviceConfig = { LoadCredential = [ "surtr.priv" ]; }; }; systemd.network = { netdevs = { vpn = { netdevConfig = { Name = "vpn"; Kind = "wireguard"; }; wireguardConfig = { PrivateKeyFile = "/run/credentials/systemd-networkd.service/surtr.priv"; ListenPort = 51820; }; wireguardPeers = imap1 (i: { name, ip ? i }: { AllowedIPs = ["${prefix6}:${toString ip}::/96" "${prefix4}.${toString ip}/32"]; PublicKey = trim (readFile (./. + "/${name}.pub")); }) [ { name = "geri"; } { name = "sif"; } ]; }; }; networks = { upstream = { name = "upstream"; matchConfig = { Name = "upstream"; }; linkConfig = { RequiredForOnline = true; }; networkConfig = { Address = [ "185.243.10.86/32" "2a03:4000:20:259::/64" ]; LLMNR = false; MulticastDNS = false; }; routes = [ { Destination = "202.61.240.1"; } { Destination = "0.0.0.0/0"; Gateway = "202.61.240.1"; } { Destination = "::/0"; Gateway = "fe80::1"; } ]; extraConfig = '' [Neighbor] Address=202.61.240.1 LinkLayerAddress=00:00:5e:00:01:01 ''; }; vpn = { name = "vpn"; matchConfig = { Name = "vpn"; }; address = ["${prefix6}::/96" "${prefix4}.0/32"]; routes = [ { Destination = "${prefix6}::/80"; } { Destination = "${prefix4}.0/24"; } ]; linkConfig = { RequiredForOnline = false; }; networkConfig = { LLMNR = false; MulticastDNS = false; }; }; }; }; }; }; systemd.services = { "container@vpn" = { serviceConfig = { LoadCredential = [ "surtr.priv:${config.sops.secrets.vpn.path}" ]; }; }; }; sops.secrets.vpn = { format = "binary"; sopsFile = ./surtr.priv; }; }; }