Rework vpn config, change to VM

machines/vpn/configuration.nix

@@ -1,4 +1,8 @@
-{ self, ... } @ inputs: {
+{ self, ... } @ inputs:
+let
+  pkgs = self.inputs.nixpkgs.legacyPackages.x86_64-linux;
+in
+{
   imports = [
     ./hardware-configuration.nix
     ../../users/root
@@ -11,35 +15,77 @@
       enable = true;
       remote-builders = true;
     };
-    services = {
+  };
-      wireguard = {
+
-        server = {
+  networking = {
-          enable = true;
+    hostName = "vpn";
-          externalInterface = "eth0";
+    useDHCP = false;
-          internalInterface = "wg0";
+
-          internalIPs = [ "10.1.0.0/24" ];
+    nat = {
-          privateKeyFile = "/run/secrets/wireguard_key";
+      enable = true;
-          peers = [
+      externalInterface = "br0";
-            # horus
+      internalInterfaces = [ "wg0" ];
-            # {
+    };
-            #   publicKey = "";
+
-            #   persistentKeepalive = 25;
+    interfaces = {
-            #   allowedIPs = [
+      br0 = {
-            #     "10.1.0.0/24"
+        ipv4.addresses = [{ address = "10.0.0.250"; prefixLength = 24; }];
-            #     "10.0.0.0/24"
+      };
-            #   ];
+      eth1 = {
-            # }
+        ipv4.addresses = [{ address = "10.2.0.20"; prefixLength = 24; }];
-            # iphone
+      };
-            {
+    };
-              publicKey = "SlJSLRMaqoujNsTkzQRZlNLBGB0Q/tt3b8KijFEaH2s=";
+
-              persistentKeepalive = 25;
+    firewall.trustedInterfaces = [ "eth1" ];
-              allowedIPs = [
+
-                "10.1.0.0/24"
+    bridges = {
-                "10.0.0.0/24"
+      br0 = {
-              ];
+        interfaces = [ "eth0" ];
-            }
+        rstp = true;
-          ];
+      };
-        };
+    };
+
+    defaultGateway = {
+      address = "10.2.0.1";
+      interface = "eth1";
+    };
+    nameservers = [ "10.0.0.254" ];
+
+    wireguard.interfaces = {
+      wg0 = {
+        ips = [ "10.1.0.0/24" ];
+        listenPort = 51820;
+        privateKeyFile = "/run/secrets/wireguard_key";
+        postSetup = [
+          "${pkgs.iptables}/bin/iptables -A FORWARD -i %i -j ACCEPT"
+          "${pkgs.iptables}/bin/iptables -A FORWARD -o %i -j ACCEPT"
+          "${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE"
+        ];
+        postShutdown = [
+          "${pkgs.iptables}/bin/iptables -D FORWARD -i %i -j ACCEPT"
+          "${pkgs.iptables}/bin/iptables -D FORWARD -o %i -j ACCEPT"
+          "${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o br0 -j MASQUERADE"
+        ];
+        peers = [
+          # horus
+          # {
+          #   publicKey = "";
+          #   persistentKeepalive = 25;
+          #   allowedIPs = [
+          #     "10.1.0.0/24"
+          #     "10.0.0.0/24"
+          #   ];
+          # }
+          # iphone
+          {
+            publicKey = "SlJSLRMaqoujNsTkzQRZlNLBGB0Q/tt3b8KijFEaH2s=";
+            persistentKeepalive = 25;
+            allowedIPs = [
+              "10.1.0.0/24"
+              "10.0.0.0/24"
+            ];
+          }
+        ];
       };
     };
   };
@@ -54,10 +100,6 @@
 
   services.openssh.enable = true;
 
-  proxmoxLXC = {
-    privileged = true;
-  };
-
   sops.defaultSopsFile = ./secrets.yaml;
   sops.secrets = {
     wireguard_key = { };

machines/vpn/hardware-configuration.nix

@@ -5,6 +5,6 @@
 , ...
 }: {
   imports = [
-    (modulesPath + "/virtualisation/proxmox-lxc.nix")
+    (modulesPath + "/virtualisation/proxmox-image.nix")
   ];
 }