something is seriously broken rn

5 files changed, 111 insertions, 34 deletions

diff --git a/hosts/ganymede/caddy.nix b/hosts/ganymede/caddy.nix
index 08a779b..06ca720 100644
--- a/hosts/ganymede/caddy.nix
+++ b/hosts/ganymede/caddy.nix
@@ -36,6 +36,11 @@
     };
   };
 
+  # merge logs from subdomains
+  services.caddy.virtualHosts."jta.williamsfam.us.com".logFormat = lib.mkForce ''
+    output file /var/log/caddy/access-williamsfam.us.com.log
+  '';
+
   collinux.services.glance.homelabServices."website" = {
     url = "https://williamsfam.us.com";
     icon = "mdi:web";
diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix
index ed397ef..92eddee 100644
--- a/hosts/ganymede/config.nix
+++ b/hosts/ganymede/config.nix
@@ -28,19 +28,6 @@
       };
     };
 
-    system.network = {
-      dns.areYouAServer = true;
-      static = {
-        ip = "192.168.50.2/24";
-        gateway = "192.168.50.1";
-      };
-
-      wireless.static = {
-        ssid = "williams";
-        pskFile = config.collinux.secrets."williams-psk".path;
-      };
-    };
-
     services = {
       sshd.enable = true; # :22
       minecraft.enable = true; # :19132
diff --git a/hosts/ganymede/networking.nix b/hosts/ganymede/networking.nix
new file mode 100644
index 0000000..082068c
--- /dev/null
+++ b/hosts/ganymede/networking.nix
@@ -0,0 +1,80 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  static = {
+    ssid = "williams";
+    pskFile = config.collinux.secrets."williams-psk".path;
+    ip = "192.168.50.2/24";
+    gateway = "192.168.50.1";
+  };
+in {
+  networking = {
+    dhcpcd.enable = false;
+    useDHCP = false;
+    networkmanager.enable = false;
+
+    useNetworkd = true;
+
+    firewall = {
+      enable = true;
+      checkReversePath = "loose";
+    };
+
+    resolvconf.enable = true;
+    nameservers = ["127.0.0.1"];
+
+    wireless = {
+      enable = true;
+      networks.${static.ssid}.pskRaw = "ext:psk";
+      secretsFile = static.pskFile;
+    };
+  };
+  systemd = {
+    services."disable-wifi-powersave" = {
+      description = "Disable wifi powersaving using iw";
+      after = ["network.target"];
+      serviceConfig.ExecStart = "${lib.getExe pkgs.iw} dev wlp108s0 set power_save off";
+      wantedBy = ["default.target"];
+    };
+
+    network = {
+      enable = true;
+      wait-online = {
+        enable = true;
+        anyInterface = true;
+      };
+
+      networks."11-default" = {
+        name = "wl*";
+        networkConfig = {
+          Address = static.ip;
+          Gateway = static.gateway;
+          DHCP = "no";
+        };
+      };
+    };
+  };
+
+  services = {
+    resolved.enable = false;
+
+    unbound = {
+      enable = true;
+      settings.server = {
+        interface = ["0.0.0.0"];
+        port = 53;
+        access-control = [
+          "127.0.0.0/8 allow"
+          "10.100.0.0/24 allow"
+          "0.0.0.0/0 refuse"
+        ];
+
+        local-zone = [''"ganymede." redirect''];
+        local-data = [''"ganymede. IN A 10.100.0.1"''];
+      };
+    };
+  };
+}
diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix
index 873cd2f..314b72a 100644
--- a/hosts/ganymede/nixos.nix
+++ b/hosts/ganymede/nixos.nix
@@ -1,31 +1,15 @@
-{
-  config,
-  pkgs,
-  lib,
-  inputs,
-  ...
-}: {
+{inputs, ...}: {
   imports = [
     inputs.disko.nixosModules.disko
     inputs.nixos-facter-modules.nixosModules.facter
     ./disks.nix
     ./caddy.nix
+
+    ./networking.nix
     ./wireguard.nix
   ];
 
   facter.reportPath = ./facter.json;
 
-  systemd.services."disable-wifi-powersave" = {
-    description = "Disable wifi powersaving using iw";
-    after = ["network.target"];
-    serviceConfig.ExecStart = "${pkgs.iw}/bin/iw dev wlp108s0 set power_save off";
-    wantedBy = ["default.target"];
-  };
-
   services.fail2ban.enable = true;
-
-  # merge logs from subdomains
-  services.caddy.virtualHosts."jta.williamsfam.us.com".logFormat = lib.mkForce ''
-    output file /var/log/caddy/access-williamsfam.us.com.log
-  '';
 }
diff --git a/hosts/ganymede/wireguard.nix b/hosts/ganymede/wireguard.nix
index de7afb5..3c3f1d6 100644
--- a/hosts/ganymede/wireguard.nix
+++ b/hosts/ganymede/wireguard.nix
@@ -2,6 +2,7 @@
   config,
   hosts,
   pkgs,
+  lib,
   ...
 }: {
   environment.systemPackages = [pkgs.wireguard-tools];
@@ -10,19 +11,36 @@
 
   networking.firewall = {
     allowedUDPPorts = [51820];
-    trustedInterfaces = ["wg0"]; # bypass firewall inside wireguard
+    allowedTCPPorts = [51843];
+
+    trustedInterfaces = ["wg0"];
+  };
+
+  systemd.services.udp2raw-server = {
+    description = "udp2raw WireGuard transport";
+    wantedBy = ["multi-user.target"];
+    after = ["network-online.target"];
+    wants = ["network-online.target"];
+
+    serviceConfig = {
+      ExecStart = "${lib.getExe pkgs.udp2raw} -s -l 0.0.0.0:51843 -r 127.0.0.1:51820 -k shared-secret -a";
+      Restart = "on-failure";
+      RestartSec = "2s";
+    };
   };
 
   systemd.network.netdevs."50-wg0" = {
     netdevConfig = {
       Kind = "wireguard";
       Name = "wg0";
-      MTUBytes = "1300";
+      MTUBytes = 1200;
     };
+
     wireguardConfig = {
       PrivateKeyFile = config.collinux.secrets."wireguard-privkey".path;
       ListenPort = 51820;
     };
+
     wireguardPeers = [
       {
         PublicKey = hosts.mercury.wg_pubkey;
@@ -34,9 +52,12 @@
       }
     ];
   };
+
   systemd.network.networks."wg0" = {
     matchConfig.Name = "wg0";
+
     address = ["${hosts.ganymede.wg_ip}/24"];
+
     networkConfig = {
       IPMasquerade = "ipv4";
       IPv4Forwarding = true;