From 1cec47e1e21f17f1e9ca481401abb18b345796d1 Mon Sep 17 00:00:00 2001
From: Dmitriy Pleshevskiy <dmitriy@pleshevski.ru>
Date: Thu, 18 Apr 2024 12:54:40 +0300
Subject: [PATCH] host/tatos: fix configs

---
 .../networking.secret.nix                       | Bin 929 -> 567 bytes
 hosts/tatos/services/default.nix                |   5 ++++-
 hosts/tatos/services/dns.nix                    |   4 ++--
 hosts/tatos/services/wireguard/default.nix      |  16 ++++++----------
 .../services/wireguard/update_ru_routes.sh      |   1 +
 5 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/hosts/tatos/hardware-configuration/networking.secret.nix b/hosts/tatos/hardware-configuration/networking.secret.nix
index b9c19be4d36529e378bc95a7feea56da0563dfb0..9913d7d8227c8f6f9ace6c4ade83c8650402746d 100644
GIT binary patch
literal 567
zcmV-70?7RUM@dveQdv+`0IA6pA_Ny69UkDlUE?wMF)2Nk-<`<)(x~Mdw&0xu<I-Z7
zOEmhwpKI<cYnH&(8Ym&lsF45Wc~A%Bdf`NBNv;P$3^6D}$4|oR!K-#Q+*<yFKtE;F
zZ*S8b0P^6%G?9PSgBQhko!na?l;?%?Jgen2J4vB=%Plkq-#XM?8}dDCZrmy$c8o`r
zKtRORE|PY^gzu^t*3rL<){hKq1Eh1P(Azfv<u_WFoARa))w1rd<v(*i%2eze1Q*?#
zR*`+J`j@Kx@!Fu9&9@Vx4hWHT)9-u&WBk9o-zMl}Zj<1v@A;1MrS6I1oW@dJso*9_
zr`P3tv0{J0PgFscc~-nZ_d^P8d5;*`(Z3QJ!wmH$P*A>otuRnXXSDUAi37G-can)t
z3*=Xeu>u)wnUMkEb?v_vmH)H2lJv<VX+ca4=9#a0uF!}Z@1BWiMAt`qgMX>~Ri*Kz
z9&k?jEfQPLA+ajCB_h$76x>$$Sv*hpOJ>eVcIOFh*|el|(-h3tgv1bSx)Wd$MRYrC
z#FpyNIURyo!&Th93z0b&LElM3!g-{fK2O~?amkYh%wZ7xIDz;DdueFB9-v=pGPt=8
zHgx<lkL*_erxY#<vx0U!-mD6?Il!VD_~8OV%~fXLPcOV3J{(AuIM^Mds%4R?lL#)j
zgmYYc45?W)k5pq-fKN}1AcAGz%4lgG78%kX%>C5fyhVSOW$%C90SBC4!7Pn~iIzIN
Fj-x`}8>;{S

literal 929
zcmV;S177?9M@dveQdv+`0I<cb1ztLh@HZO4V`@Brj?Dv1G+#<RE$_Y$SG!YOvgr48
z2gdo=uN{v=CYt|Ba0{Ug_yp32xIy*T_P;mc=Cjhg;`jU0;1K^Ea2P0Vx@QvZh3-}q
zhG#zgPl2>0L__yBDIIDg?dv&a{x)Z5q6x&r+t9vF+JPJ|ZH315Ry87z<egPZ_n!V<
z{d_?5p7G2T<yEEKe|Rbj>E%KU#MRdH_7?raccFGrANxt;YH-RA{t~CahGX08MnsT$
zzWH;<caF*Aneb%BRb#4<zXwp|#WwP^JJCJ`xthbYIFL-m-2)M*Y{X^pkyt19;nUn|
z-z3oI4;(dZQ&bfnXP8uX_K%q2c_-aoI!>oH(+W@u?(FHlg@6~^cM!j2LLH;)Awi%L
zS9xYNEPx-0M<I^XNJ-CTOVzSlB?nck@*f6i&o)NOvL!^r+0a@8mqs3ZnXbt=`C%lg
z1~^ypd|T-9`JDD}D;9V`YG~5Bi{En`0+0{VmUAfAAch*$(1Yei@pdrwc2d>Px$BLV
zu<vYGh4t^oL@8JnG|%(Fql)A3Fg8K+V3AN9M*(VAZbQsAB#6bNZUos8x<3{eSFfFZ
zbvNj<(hngClQxybZDvhwj|A6(y1g`Xxm<gMS{|~9l)J|?EpYJWS7$m_t|AbF!PNPV
zXxN!L@u$yEgmwBs#(5xxEx&gaNyuVf6s~bkv`hc!VEv<f-s&d&DqHp9kIK=8p_1%B
zq4PV(+VPY{%T*fA>_ovmzxtK{A6pMD>{M2M|1Z7hcv^(m(GE?a1NR<M?;L-EqDGJ6
zk9+$z7KrQu_bAja$)7JewqjSp8bjBttt{;3>vcpz*lv}F_H_~zYhc=})_VSsYKt1w
z8!oj~VnsUpv$W-Nc5e$k4$F$C!L8*cdLyxhyixDeT*S>SMb6EXf*=Ro>fNCFlo`?{
z+#|O>u+WU%YjZP1hxBJ#h0z*t&&J;c%t^F_*lNQf=&=)xvD~khwBQRRgW3@DrUd?~
z!T>`)VJVR8^UNeQ_~V7|ggYgDiy{b5w50&rpp(ovFFJWF_rJGYuj$U2K@nl&K7_Ie
ztr`Uou#l2cl9>D-u@B%n?8~WuYt<C56yc-K?eh!xz+7Rt?IO;fmQic-uQbG4Lrg~)
z-Uojt{jueDQ6*gL`V8>YK`x@Lg7y9XC;T|vQ2iX{CceWOiCT{t{R`LZ_CWr|p`$wg
D;4tCi

diff --git a/hosts/tatos/services/default.nix b/hosts/tatos/services/default.nix
index 9ac1f8d..569f148 100644
--- a/hosts/tatos/services/default.nix
+++ b/hosts/tatos/services/default.nix
@@ -1,5 +1,8 @@
 { ... }:
 
 {
-  imports = [ ./wireguard ];
+  imports = [
+    ./wireguard
+    ./dns.nix
+  ];
 }
diff --git a/hosts/tatos/services/dns.nix b/hosts/tatos/services/dns.nix
index e2c19ef..52f8293 100644
--- a/hosts/tatos/services/dns.nix
+++ b/hosts/tatos/services/dns.nix
@@ -2,7 +2,7 @@
 
 let dnsport = 53; in
 {
-  services.dnscrypt-proxy2.settings.listen_addresses = [ "[::1]:51" ];
+  services.dnscrypt-proxy2.settings.listen_addresses = [ "127.0.0.1:51" "[::1]:51" ];
 
   # Forward loopback traffic on port 53 to dnscrypt-proxy2.
   networking.firewall.extraCommands = ''
@@ -25,4 +25,4 @@ let dnsport = 53; in
       interface = "wg0";
     };
   };
-};
+}
diff --git a/hosts/tatos/services/wireguard/default.nix b/hosts/tatos/services/wireguard/default.nix
index d8082d2..d410a4e 100644
--- a/hosts/tatos/services/wireguard/default.nix
+++ b/hosts/tatos/services/wireguard/default.nix
@@ -7,7 +7,6 @@ let
 
   tatosData = import ../../data.secret.nix;
   port = tatosData.wireguard.port;
-
 in
 {
   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
@@ -20,20 +19,19 @@ in
     internalInterfaces = [ "wg0" ];
   };
 
+  networking.firewall.allowedUDPPorts = [ port ];
+
   services.cron =
-    let
-      update_ru_routes = pkgs.callPackage ./update_ru_routes.nix { };
-      cmd = "${update_ru_routes}/bin/update_ru_routes > /root/update_routes.log 2>&1";
-    in
+    let update_ru_routes = pkgs.callPackage ./update_ru_routes.nix { }; in
+    let cmd = "${update_ru_routes}/bin/update_ru_routes > /root/update_routes.log 2>&1"; in
     {
       enable = true;
       systemCronJobs = [
-        "@reboot sleep 30 && ${cmd}"
-        "0 3 * * mon ${cmd}"
+        "@reboot      root  sleep 30 && ${cmd}"
+        "0 3 * * mon  root  ${cmd}"
       ];
     };
 
-
   networking.wg-quick.interfaces = {
     # "wg0" is the network interface name. You can name the interface arbitrarily.
     wg0 = {
@@ -46,13 +44,11 @@ in
       # This allows the wireguard server to route your traffic to the internet and hence be like a VPN
       # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
       postUp = ''
-        gateway=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $3; exit}'`
         interface=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $5; exit}'`
         ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o $interface -j MASQUERADE
         ${pkgs.iproute}/bin/ip rule add from ${tatosData.addr} table main
       '';
       preDown = ''
-        gateway=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $3; exit}'`
         interface=`${pkgs.iproute}/bin/ip route | ${pkgs.gawk}/bin/awk '/default/ {print $5; exit}'`
         ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o $interface -j MASQUERADE
         ${pkgs.iproute}/bin/ip rule del from ${tatosData.addr} table main
diff --git a/hosts/tatos/services/wireguard/update_ru_routes.sh b/hosts/tatos/services/wireguard/update_ru_routes.sh
index ff497cc..322c124 100644
--- a/hosts/tatos/services/wireguard/update_ru_routes.sh
+++ b/hosts/tatos/services/wireguard/update_ru_routes.sh
@@ -20,6 +20,7 @@ interface=`ip route | awk '/default/ {print $5; exit}'`
 # Get addresses RU segment
 echo "Add stat.ripe.net to $interface"
 ip route add 193.0.6.150/32 via $gateway_for_internal_ip dev $interface
+
 echo "Download RU subnets..."
 curl --progress-bar "https://stat.ripe.net/data/country-resource-list/data.json?resource=ru" | jq -r ".data.resources.ipv4[]" > $file_raw