bash: fix mem-top

[sourcephile-nix.git] / hosts / losurdo / networking / wireguard / intranet.nix

diff --git a/hosts/losurdo/networking/wireguard/intranet.nix b/hosts/losurdo/networking/wireguard/intranet.nix
index bb27bdea0d48a3419041f078e66eb0e47e02d289..29761404a2c457954060243c0e7a94184567581c 100644 (file)
--- a/hosts/losurdo/networking/wireguard/intranet.nix
+++ b/hosts/losurdo/networking/wireguard/intranet.nix
@@ -1,24 +1,16 @@
-{ pkgs, lib, config, hosts, ... }:
+{ pkgs, lib, config, inputs, ... }:
 let
-  inherit (builtins) hasAttr removeAttrs;
   inherit (config.security) gnupg;
   inherit (config.boot) initrd;
   iface = "wg-intra";
   wg = config.networking.wireguard.interfaces.${iface};
-  relay =
-    hosts.mermet.extraArgs //
-    hosts.mermet.config.networking.wireguard.interfaces.${iface} //
-    lib.head (lib.filter (peer:
-      peer.endpoint != null &&
-      builtins.match "^\(.*\):[0-9]*$" peer.endpoint ==
-        [hosts.mermet.extraArgs.ipv4])
-      wg.peers);
+  wg-intra-hosts = import (inputs.julm-nix + "/networking/wireguard/wg-intra/hosts.nix");
+  relay = wg-intra-hosts.mermet;
 in
 {
 imports = [
-  ../../../../networking/wireguard/wg-intra.nix
+  (inputs.julm-nix + "/networking/wireguard/wg-intra.nix")
 ];
-config = {
 networking.wireguard.interfaces.${iface} = {
   privateKeyFile = gnupg.secrets."wireguard/${iface}/privateKey".path;
 };
@@ -34,12 +26,12 @@ security.gnupg.secrets."wireguard/${iface}/privateKey" = {
 systemd.services."wireguard-${iface}" = {
   after    = [ gnupg.secrets."wireguard/${iface}/privateKey".service ];
   requires = [ gnupg.secrets."wireguard/${iface}/privateKey".service ];
-  serviceConfig.Upholds = [ "upnpc-${toString wg.listenPort}.service" ];
+  unitConfig.Upholds = [ "upnpc-${toString wg.listenPort}.service" ];
 };
 networking.nftables.ruleset = ''
   # Allow initiating connection to and from other peers
-  add rule inet filter fw2net udp sport ${toString wg.listenPort} counter accept comment "${iface} output to peers"
-  add rule inet filter net2fw udp dport ${toString wg.listenPort} counter accept comment "${iface} input from peers"
+  add rule inet filter fw2net udp sport ${toString wg.listenPort} counter accept comment "WireGuard ${iface} output to peers"
+  add rule inet filter net2fw udp dport ${toString wg.listenPort} counter accept comment "WireGuard ${iface} input from peers"
 
   # Hook ${iface} into relevant chains
   add rule inet filter input  iifname "${iface}" jump intra2fw
@@ -89,7 +81,7 @@ boot.initrd.network.postCommands = ''
   wg set ${iface} private-key /root/initrd/${iface}.key \
      listen-port ${toString wg.listenPort}
   ip link set up dev ${iface}
-  wg set ${iface} peer ${relay.publicKey} \
+  wg set ${iface} peer ${relay.peer.publicKey} \
      endpoint ${relay.ipv4}:${toString relay.listenPort} \
      allowed-ips ${relay.ipv4}/32 \
      persistent-keepalive 5
@@ -98,5 +90,4 @@ boot.initrd.network.postCommands = ''
 boot.initrd.postMountCommands = lib.mkIf initrd.network.flushBeforeStage2 ''
   ip link del dev ${iface}
 '';
-};
 }