end with netbird

machines/kat-mail-test/default.nix

@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  nodes,
   sources,
   ...
 }:
@@ -21,38 +22,62 @@ in
     efi.canTouchEfiVariables = true;
   };
 
-  networking = {
+  kat.wireguardPubKey = "Znj451+hGJcPV1zFgpRMA8hg8edmUInA5zBtYBUuL3k=";
-    useNetworkd = lib.mkForce false;
+  systemd.network = {
-    interfaces."enp1s0" = {
+    networks = {
-      useDHCP = false;
+      "10-enp1s0" = {
-      ipv4.addresses = [
+        name = "enp1s0";
+        address = [
+          "192.168.122.3/24"
+          "fe80::3/64"
+        ];
+        routes = [
           {
-          address = "192.168.122.3";
+            routeConfig = {
-          prefixLength = 24;
+              Destination = "10.42.0.2/32";
+              Gateway = "192.168.122.1";
+            };
           }
         ];
-      ipv6.addresses = [
+        dns = [ "192.168.122.1" ];
+      };
+      "50-wg0" = {
+        name = "wg0";
+        address = [ "10.42.2.1/16" ];
+        routes = [
           {
-          address = "fe80::3";
+            routeConfig.Gateway = "10.42.0.2";
-          prefixLength = 64;
           }
         ];
       };
-    defaultGateway = "192.168.122.1";
-    defaultGateway6 = {
-      address = "fe80::1";
-      interface = "enp1s0";
     };
-    nameservers = [
+    netdevs = {
-      "192.168.122.1"
+      "50-wg0" = {
-      "fe80::1%enp1s0"
+        netdevConfig = {
-    ];
+          Name = "wg0";
+          Kind = "wireguard";
+        };
+        wireguardConfig = {
+          PrivateKeyFile = "/wg/private.key";
         };
 
-  services = {
+        wireguardPeers = [
-    openssh.enable = true;
+          {
-    netbird.enable = true;
+            Endpoint = "10.42.0.2:1194";
+            AllowedIPs = [
+              "0.0.0.0/0"
+            ];
+            PersistentKeepalive = 20;
+            PublicKey = nodes.kat-watcher.config.kat.wireguardPubKey;
+          }
+        ];
       };
+    };
+  };
+
+  networking.useDHCP = false;
+
+  services.openssh.enable = true;
 
   networking.firewall.enable = false;
 
@@ -81,7 +106,10 @@ in
     loginAccounts = {
       "root@${host}" = {
         catchAll = [ host ];
-        aliases = builtins.genList (id: "user${toString id}@${host}") 10 ++ [ "moderators@${host}" "daemon@${host}" ];
+        aliases = builtins.genList (id: "user${toString id}@${host}") 10 ++ [
+          "moderators@${host}"
+          "daemon@${host}"
+        ];
         hashedPassword = "$2b$05$FoCVDECXYG0KXPigPuIZtuNFiviwSg8RuXx0FbnzC7ZRp.Mz8VWOe";
       };
     };

machines/kat-manah/default.nix

@@ -28,18 +28,7 @@
     networks = {
       "50-wg0" = {
         name = "wg0";
-        addresses = [
+        address = [ "10.42.0.1/16" ];
-          {
-            Address = "10.42.0.1/16";
-            AddPrefixRoute = false;
-          }
-        ];
-        routes = [
-          {
-            Destination = "10.42.0.0/16";
-            Source = "10.42.0.1";
-          }
-        ];
       };
     };
     netdevs = {
@@ -72,7 +61,6 @@
   ];
 
   services.openssh.enable = true;
-  services.netbird.enable = true;
 
   programs.virt-manager.enable = true;
   virtualisation.libvirtd.enable = true;

machines/kat-watcher/default.nix

@@ -17,11 +17,24 @@
     efiInstallAsRemovable = true;
   };
 
+  boot.kernel.sysctl."net.ipv4.ip_forward" = true;
   kat.wireguardPubKey = "BgLBrWG7DRj2Gwoyj+vHZTjiB3gPEnwVcDFEQH/BYgg=";
 
   networking = {
     useDHCP = false;
     firewall.allowedUDPPorts = [ 1194 ];
+    nftables = {
+      enable = true;
+      tables.nat = {
+        family = "ip";
+        content = ''
+          chain postrouting {
+            type nat hook postrouting priority 100;
+            ip saddr 10.42.0.0/16 masquerade
+          }
+        '';
+      };
+    };
   };
   systemd.network = {
     enable = true;
@@ -45,18 +58,7 @@
       };
       "50-wg0" = {
         name = "wg0";
-        addresses = [
+        address = [ "10.42.0.2/16" ];
-          {
-            Address = "10.42.0.2/16";
-            AddPrefixRoute = false;
-          }
-        ];
-        routes = [
-          {
-            Destination = "10.42.0.0/16";
-            Source = "10.42.0.2";
-          }
-        ];
       };
     };
     netdevs = {
@@ -83,6 +85,12 @@
             ];
             PublicKey = nodes.kat-probook.config.kat.wireguardPubKey;
           }
+          {
+            AllowedIPs = [
+              "10.42.2.1/32"
+            ];
+            PublicKey = nodes.kat-mail-test.config.kat.wireguardPubKey;
+          }
         ];
       };
     };