Add wireguard

modules/home/desktop/productivity.nix

@@ -13,13 +13,17 @@
 
       # webgl
       chromium
+      mullvad-browser
+
+      # password manager
+      bitwarden-desktop
     ];
 
     home.sessionVariables.BROWSER = "librewolf";
     programs.zsh.sessionVariables.BROWSER = "librewolf";
 
     programs.librewolf = {
-      enable = true;
+      enable = false;
       settings = {
         "webgl.disabled" = true;
         "privacy.resistFingerprinting" = true;
@@ -29,8 +33,8 @@
       };
     };
 
-    programs.qutebrowser = {
-      enable = true;
-    };
+    # programs.qutebrowser = {
+    #   enable = true;
+    # };
   };
 }

modules/nixos/core/network.nix

@@ -1,6 +1,7 @@
 { pkgs, lib, config, ... }: {
   options.mods = {
     tailscale.enable = lib.mkEnableOption "enables tailscale";
+    wireguard.enable = lib.mkEnableOption "enables wireguard client";
     openvpn.enable = lib.mkEnableOption "enables openvpn config";
     openvpn.config = let 
       username = "${config.mods.user.name}";
@@ -20,5 +21,30 @@
     services.openvpn.servers = lib.mkIf config.mods.openvpn.enable {
       remote.config = ''config ${config.mods.openvpn.config}'';
     };
+
+
+    networking = lib.mkIf config.mods.wireguard.enable {
+      firewall = {
+        allowedUDPPorts = [ 51820 ]; # Clients and peers can use the same port, see listenport
+      };
+      wireguard.interfaces = {
+        wg0 = {
+          ips = [ "10.100.0.2/24" ];
+          listenPort = 51820;
+
+          privateKeyFile = "/home/muon/wireguard-keys/private";
+
+          peers = [
+            {
+              publicKey = "2RF8GmTZwQdzVm2l2piYy6U0qiMU3wSxC7Lt8urAjwA=";
+              allowedIPs = [ "0.0.0.0/0" ];
+              endpoint = "{server ip}:51820";
+              persistentKeepalive = 25;
+            }
+          ];
+        };
+      };
+    };
+
   };
 }

modules/nixos/server/containers/steam.nix

@@ -20,8 +20,8 @@ in {
       privateNetwork = true;
       # hostAddress = "192.168.100.10";
       # localAddress = "192.168.100.11";
-      hostBridge = "br0"; # Specify the bridge name
-      localAddress = "192.168.1.171/24";
+      # hostBridge = "br0"; # Specify the bridge name
+      # localAddress = "192.168.1.171/24";
 
       bindMounts = {
         "/home/steam/.steam/steam/steamapps/common/SMITE" = {

modules/nixos/server/default.nix

@@ -6,5 +6,6 @@
 
     ./media.nix
     ./sync.nix
+    ./wireguard.nix
   ];
 }

modules/nixos/server/docker/default.nix

@@ -1,16 +1,16 @@
-{ pkgs, lib, ... }: {
+{ pkgs, lib, config, ... }: {
   imports = [
     ./media.nix
   ];
 
-  options.mods.docker.media = {
+  options.mods.docker = {
     enable = lib.mkEnableOption {
       default = false;
-      description = "enables docker containers for media server";
+      description = "enables docker containers";
     };
   };
 
-  config = lib.mkIf config.mods.docker.media.enable {
+  config = lib.mkIf config.mods.docker.enable {
     environment.systemPackages = [
       pkgs.arion
 
@@ -27,6 +27,6 @@
     virtualisation.podman.defaultNetwork.dnsname.enable = true;
 
     # Use your username instead of `myuser`
-    users.extraUsers.${mods.user.name}.extraGroups = ["podman"];
+    users.extraUsers.${config.mods.user.name}.extraGroups = ["podman"];
   };
 }

modules/nixos/server/docker/media.nix

@@ -7,24 +7,24 @@
   };
 
   config = lib.mkIf config.mods.docker.media.enable {
-    virtualisation.arion = {
-      backend = "docker";
-      projects = {
-        "hyperpipe".settings.services = {
-          "hyperpipe-frontend".service = {
-            image = "codeberg.org/hyperpipe/hyperpipe:latest";
-            container-name = "hyperpipe-frontend";
-            restart = "unless-stopped";
-            ports = ["8080:80"];
-          };
-          "hyperpipe-backend".service = {
-            image = "codeberg.org/hyperpipe/hyperpipe:latest";
-            container_name = "hyperpipe-backend";
-            restart = "unless-stopped";
-            ports = ["3000:3000"];
-          };
-        };
-      };
-    };
+    # virtualisation.arion = {
+    #   backend = "docker";
+    #   projects = {
+    #     "hyperpipe".settings.services = {
+    #       "hyperpipe-frontend".service = {
+    #         image = "codeberg.org/hyperpipe/hyperpipe:latest";
+    #         container-name = "hyperpipe-frontend";
+    #         restart = "unless-stopped";
+    #         ports = ["8080:80"];
+    #       };
+    #       "hyperpipe-backend".service = {
+    #         image = "codeberg.org/hyperpipe/hyperpipe:latest";
+    #         container_name = "hyperpipe-backend";
+    #         restart = "unless-stopped";
+    #         ports = ["3000:3000"];
+    #       };
+    #     };
+    #   };
+    # };
   };
 }

modules/nixos/server/wireguard.nix

@@ -0,0 +1,45 @@
+{ pkgs, lib, config, ... }: {
+  options.mods.server.wireguard = {
+    enable = lib.mkEnableOption {
+      default = false;
+      description = "enables wireguard server";
+    };
+  };
+
+
+  config = lib.mkIf config.mods.server.wireguard.enable {
+    networking.nat.enable = true;
+    networking.nat.externalInterface = "ens3";
+    networking.nat.internalInterfaces = [ "wg0" ];
+    networking.firewall = {
+      allowedUDPPorts = [ 51820 ];
+    };
+
+    networking.wireguard.interfaces = {
+      wg0 = {
+        ips = [ "10.100.0.1/24" ];
+
+        listenPort = 51820;
+
+        postSetup = ''
+          ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        '';
+
+        # This undoes the above command
+        postShutdown = ''
+          ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        '';
+
+        privateKeyFile = "/home/muon/wireguard-keys/private";
+
+        peers = [
+          { 
+            publicKey = "MDBdADwP/SE/T9cadXB1Mup7Dr3x+l6gBFBN83BU4Dg=";
+            allowedIPs = [ "10.100.0.2/32" ];
+          }
+        ];
+      };
+    };
+
+  };
+}