system/nixos/hosts/tatos/services/wireguard.nix

{ config, pkgs, ... }:

# Source: https://habr.com/ru/companies/xakep/articles/699000/

let
  istalData = import ../../istal/data.secret.nix;

  tatosData = import ../data.secret.nix;
  port = tatosData.wireguard.port;

  update_ru_routes = pkgs.callPackage ./update_ru_routes.nix { };

  dnsport = 53;
in
{
  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  boot.kernel.sysctl."net.ipv4.conf.all.forwarding" = 1;

  # enable NAT
  networking.nat = {
    enable = true;
    externalInterface = "eth0";
    internalInterfaces = [ "wg0" ];
  };

  networking.firewall = {
    allowedTCPPorts = [ dnsport ];
    allowedUDPPorts = [ dnsport port ];
  };

  services.dnsmasq = {
    enable = true;
    settings = {
      interface = "wg0";
    };
  };

  environment.systemPackages = [ update_ru_routes ];

  networking.wg-quick.interfaces = {
    # "wg0" is the network interface name. You can name the interface arbitrarily.
    wg0 = {
      # Determines the IP address and subnet of the server's end of the tunnel interface.
      address = [ "10.20.30.1/32" ];

      # The port that WireGuard listens to. Must be accessible by the client.
      listenPort = port;

      # This allows the wireguard server to route your traffic to the internet and hence be like a VPN
      # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
      postUp = ''
        gateway=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $3; exit}'`
        interface=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $5; exit}'`
        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o $interface -j MASQUERADE
        ${pkgs.iproute}/bin/ip rule add from ${tatosData.addr} table main
      '';
      preDown = ''
        gateway=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $3; exit}'`
        interface=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $5; exit}'`
        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o $interface -j MASQUERADE
        ${pkgs.iproute}/bin/ip rule del from ${tatosData.addr} table main
      '';

      # Path to the private key file.
      privateKeyFile = config.age.secrets.wireguard-tatos-private.path;

      peers = [
        # Istal
        {
          publicKey = istalData.wireguard.publicKey;
          allowedIPs = [ "10.20.30.2/32" "0.0.0.0/0" ];
        }
        # Home
        {
          publicKey = "Gg+p7tysAhu2X841weBiQrqoKXh6kvcmDiCY62rLwQg=";
          allowedIPs = [ "10.20.30.3/32" ];
        }
        # Asus
        {
          publicKey = "mzVH0N3q7UE/XjMwgRks+D8KFuIj91VkOK2ytgjsnkw=";
          allowedIPs = [ "10.20.30.4/32" ];
        }
        # Phone 1
        {
          publicKey = "bwKSB61krDPZV9JVw2ChPCImxqjJHQ2vXvWjbqPy/2o=";
          allowedIPs = [ "10.20.30.5/32" ];
        }
        # Phone 2
        {
          publicKey = "0+ejwId5JcTeMvoz+I/ACpmpUFjD7rl9wqz8H/OAHEw=";
          allowedIPs = [ "10.20.30.6/32" ];
        }
      ];
    };
  };

  age.secrets.wireguard-tatos-private = {
    file = ../../../../secrets/wireguard-tatos-private.age;
    mode = "0400";
  };
}