host/tatos: fix configs

hosts/tatos/services/default.nix

@@ -1,5 +1,8 @@
 { ... }:
 
 {
-  imports = [ ./wireguard ];
+  imports = [
+    ./wireguard
+    ./dns.nix
+  ];
 }

hosts/tatos/services/dns.nix

@@ -2,7 +2,7 @@
 
 let dnsport = 53; in
 {
-  services.dnscrypt-proxy2.settings.listen_addresses = [ "[::1]:51" ];
+  services.dnscrypt-proxy2.settings.listen_addresses = [ "127.0.0.1:51" "[::1]:51" ];
 
   # Forward loopback traffic on port 53 to dnscrypt-proxy2.
   networking.firewall.extraCommands = ''
@@ -25,4 +25,4 @@ let dnsport = 53; in
       interface = "wg0";
     };
   };
-};
+}

hosts/tatos/services/wireguard/default.nix

@@ -7,7 +7,6 @@ let
 
   tatosData = import ../../data.secret.nix;
   port = tatosData.wireguard.port;
-
 in
 {
   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
@@ -20,20 +19,19 @@ in
     internalInterfaces = [ "wg0" ];
   };
 
+  networking.firewall.allowedUDPPorts = [ port ];
+
   services.cron =
-    let
-      update_ru_routes = pkgs.callPackage ./update_ru_routes.nix { };
-      cmd = "${update_ru_routes}/bin/update_ru_routes > /root/update_routes.log 2>&1";
-    in
+    let update_ru_routes = pkgs.callPackage ./update_ru_routes.nix { }; in
+    let cmd = "${update_ru_routes}/bin/update_ru_routes > /root/update_routes.log 2>&1"; in
     {
       enable = true;
       systemCronJobs = [
-        "@reboot sleep 30 && ${cmd}"
-        "0 3 * * mon ${cmd}"
+        "@reboot      root  sleep 30 && ${cmd}"
+        "0 3 * * mon  root  ${cmd}"
       ];
     };
 
-
   networking.wg-quick.interfaces = {
     # "wg0" is the network interface name. You can name the interface arbitrarily.
     wg0 = {
@@ -46,13 +44,11 @@ in
       # This allows the wireguard server to route your traffic to the internet and hence be like a VPN
       # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
       postUp = ''
-        gateway=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $3; exit}'`
         interface=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $5; exit}'`
         ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o $interface -j MASQUERADE
         ${pkgs.iproute}/bin/ip rule add from ${tatosData.addr} table main
       '';
       preDown = ''
-        gateway=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $3; exit}'`
         interface=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $5; exit}'`
         ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o $interface -j MASQUERADE
         ${pkgs.iproute}/bin/ip rule del from ${tatosData.addr} table main

hosts/tatos/services/wireguard/update_ru_routes.sh

@@ -20,6 +20,7 @@ interface=`ip route | awk '/default/ {print $5; exit}'`
 # Get addresses RU segment
 echo "Add stat.ripe.net to $interface"
 ip route add 193.0.6.150/32 via $gateway_for_internal_ip dev $interface
+
 echo "Download RU subnets..."
 curl --progress-bar "https://stat.ripe.net/data/country-resource-list/data.json?resource=ru" | jq -r ".data.resources.ipv4[]" > $file_raw