3 files changed, 31 insertions, 4 deletions
diff --git a/hosts/ganymede/networking.nix b/hosts/ganymede/networking.nix
index 42a66c7..72eb026 100644
--- a/hosts/ganymede/networking.nix
+++ b/hosts/ganymede/networking.nix
@@ -72,7 +72,7 @@ in {
     unbound = {
       enable = true;
       settings.server = {
-        interface = ["0.0.0.0"];
+        interface = ["0.0.0.0" "::1"];
         port = 53;
         access-control = [
           "127.0.0.0/8 allow"
diff --git a/hosts/ganymede/wireguard.nix b/hosts/ganymede/wireguard.nix
index 27d50bb..6e6ae05 100644
--- a/hosts/ganymede/wireguard.nix
+++ b/hosts/ganymede/wireguard.nix
@@ -11,15 +11,31 @@
 
   networking.firewall = {
     allowedUDPPorts = [51820];
+    allowedTCPPorts = [51843];
 
     trustedInterfaces = ["wg0"];
   };
 
+  systemd.services.udp2raw-server = {
+    description = "udp2raw WireGuard transport";
+
+    wantedBy = ["multi-user.target"];
+    after = ["network-online.target"];
+    wants = ["network-online.target"];
+
+    serviceConfig = {
+      ExecStart = "${lib.getExe pkgs.udp2raw} -s -l 0.0.0.0:51843 -r 127.0.0.1:51820 -k shared-secret -a";
+
+      Restart = "on-failure";
+      RestartSec = "2s";
+    };
+  };
+
   systemd.network.netdevs."50-wg0" = {
     netdevConfig = {
       Kind = "wireguard";
       Name = "wg0";
-      MTUBytes = 1200;
+      MTUBytes = "1200";
     };
 
     wireguardConfig = {
diff --git a/hosts/mercury/wireguard.nix b/hosts/mercury/wireguard.nix
index 1035a0e..1af84c0 100644
--- a/hosts/mercury/wireguard.nix
+++ b/hosts/mercury/wireguard.nix
@@ -7,11 +7,22 @@
 }: {
   environment.systemPackages = [pkgs.wireguard-tools];
 
+  systemd.services.udp2raw-client = {
+    description = "udp2raw WireGuard transport";
+    wantedBy = ["multi-user.target"];
+    after = ["network-online.target"];
+    wants = ["network-online.target"];
+    serviceConfig = {
+      ExecStart = "${lib.getExe pkgs.udp2raw} -c -l 127.0.0.1:51820 -r 104.53.197.192:51843 -k shared-secret -a";
+      Restart = "on-failure";
+    };
+  };
+
   systemd.network.netdevs."10-wg" = {
     netdevConfig = {
       Kind = "wireguard";
       Name = "wg0";
-      MTUBytes = 1200;
+      MTUBytes = "1200";
     };
     wireguardConfig = {
       PrivateKeyFile = config.collinux.secrets."wireguard-privkey".path;
@@ -21,7 +32,7 @@
       {
         PublicKey = hosts.ganymede.wg_pubkey;
         AllowedIPs = ["10.100.0.0/24"];
-        Endpoint = "williamsfam.us.com:51820";
+        Endpoint = "127.0.0.1:51820";
       }
     ];
   };