From 2b1c6161c5d2381cbfe224694dfb218aee0b6da1 Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Mon, 17 Aug 2026 20:48:18 -0500
Subject: something is seriously broken rn

---
 hosts/ganymede/wireguard.nix | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

(limited to 'hosts/ganymede/wireguard.nix')

diff --git a/hosts/ganymede/wireguard.nix b/hosts/ganymede/wireguard.nix
index de7afb5..3c3f1d6 100644
--- a/hosts/ganymede/wireguard.nix
+++ b/hosts/ganymede/wireguard.nix
@@ -2,6 +2,7 @@
   config,
   hosts,
   pkgs,
+  lib,
   ...
 }: {
   environment.systemPackages = [pkgs.wireguard-tools];
@@ -10,19 +11,36 @@
 
   networking.firewall = {
     allowedUDPPorts = [51820];
-    trustedInterfaces = ["wg0"]; # bypass firewall inside wireguard
+    allowedTCPPorts = [51843];
+
+    trustedInterfaces = ["wg0"];
+  };
+
+  systemd.services.udp2raw-server = {
+    description = "udp2raw WireGuard transport";
+    wantedBy = ["multi-user.target"];
+    after = ["network-online.target"];
+    wants = ["network-online.target"];
+
+    serviceConfig = {
+      ExecStart = "${lib.getExe pkgs.udp2raw} -s -l 0.0.0.0:51843 -r 127.0.0.1:51820 -k shared-secret -a";
+      Restart = "on-failure";
+      RestartSec = "2s";
+    };
   };
 
   systemd.network.netdevs."50-wg0" = {
     netdevConfig = {
       Kind = "wireguard";
       Name = "wg0";
-      MTUBytes = "1300";
+      MTUBytes = 1200;
     };
+
     wireguardConfig = {
       PrivateKeyFile = config.collinux.secrets."wireguard-privkey".path;
       ListenPort = 51820;
     };
+
     wireguardPeers = [
       {
         PublicKey = hosts.mercury.wg_pubkey;
@@ -34,9 +52,12 @@
       }
     ];
   };
+
   systemd.network.networks."wg0" = {
     matchConfig.Name = "wg0";
+
     address = ["${hosts.ganymede.wg_ip}/24"];
+
     networkConfig = {
       IPMasquerade = "ipv4";
       IPv4Forwarding = true;
-- 
cgit v1.3.1