Rework vpn config, change to VM

machines/vpn/configuration.nix

@@ -1,4 +1,8 @@
-{ self, ... } @ inputs: {
+{ self, ... } @ inputs:
+let
+  pkgs = self.inputs.nixpkgs.legacyPackages.x86_64-linux;
+in
+{
   imports = [
     ./hardware-configuration.nix
     ../../users/root
@@ -11,14 +15,57 @@
       enable = true;
       remote-builders = true;
     };
-    services = {
-      wireguard = {
-        server = {
+  };
+
+  networking = {
+    hostName = "vpn";
+    useDHCP = false;
+
+    nat = {
       enable = true;
-          externalInterface = "eth0";
-          internalInterface = "wg0";
-          internalIPs = [ "10.1.0.0/24" ];
+      externalInterface = "br0";
+      internalInterfaces = [ "wg0" ];
+    };
+
+    interfaces = {
+      br0 = {
+        ipv4.addresses = [{ address = "10.0.0.250"; prefixLength = 24; }];
+      };
+      eth1 = {
+        ipv4.addresses = [{ address = "10.2.0.20"; prefixLength = 24; }];
+      };
+    };
+
+    firewall.trustedInterfaces = [ "eth1" ];
+
+    bridges = {
+      br0 = {
+        interfaces = [ "eth0" ];
+        rstp = true;
+      };
+    };
+
+    defaultGateway = {
+      address = "10.2.0.1";
+      interface = "eth1";
+    };
+    nameservers = [ "10.0.0.254" ];
+
+    wireguard.interfaces = {
+      wg0 = {
+        ips = [ "10.1.0.0/24" ];
+        listenPort = 51820;
         privateKeyFile = "/run/secrets/wireguard_key";
+        postSetup = [
+          "${pkgs.iptables}/bin/iptables -A FORWARD -i %i -j ACCEPT"
+          "${pkgs.iptables}/bin/iptables -A FORWARD -o %i -j ACCEPT"
+          "${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE"
+        ];
+        postShutdown = [
+          "${pkgs.iptables}/bin/iptables -D FORWARD -i %i -j ACCEPT"
+          "${pkgs.iptables}/bin/iptables -D FORWARD -o %i -j ACCEPT"
+          "${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o br0 -j MASQUERADE"
+        ];
         peers = [
           # horus
           # {
@@ -42,7 +89,6 @@
       };
     };
   };
-  };
 
   boot.isContainer = true;
 
@@ -54,10 +100,6 @@
 
   services.openssh.enable = true;
 
-  proxmoxLXC = {
-    privileged = true;
-  };
-
   sops.defaultSopsFile = ./secrets.yaml;
   sops.secrets = {
     wireguard_key = { };

machines/vpn/hardware-configuration.nix

@@ -5,6 +5,6 @@
 , ...
 }: {
   imports = [
-    (modulesPath + "/virtualisation/proxmox-lxc.nix")
+    (modulesPath + "/virtualisation/proxmox-image.nix")
   ];
 }