Chickadee/hosts/vps/default.nix

{ config, lib, pkgs, ... }:

{
  imports = [
    ./hardware-configuration.nix

    ../../modules/ssh.nix

    ../../lilac.nix
  ];

  networking.hostName = "vps";

  # forwarding inbound network traffic over wireguard
  networking = {
    firewall = {
    enable = true;
    allowedTCPPorts = [ 80 443 ];
    allowedUDPPorts = [ 51820 ];
    trustedInterfaces = [ "wg0" ];
  };
  wireguard.interfaces."wg0" = {
      ips = [ "10.0.0.3/24" ];
    listenPort = 51820;
    generatePrivateKeyFile = true;
    privateKeyFile = "/var/lib/wireguard/wg0.key";
    peers = [
      {
      allowedIPs = [ "10.0.0.1/32" ];
          publicKey = "guKFJGQW946HXWjca/biMYH1nJKw0fguLjzGXKZ7Bxw=";
    }
    {
          allowedIPs = [ "10.0.0.2/32" ];
      publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
    }
    {
      allowedIPs = [ "10.0.0.4/32" ];
      publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
    }
      ];
  };
  nftables = {
    enable = true;
    tables.nat = {
      family = "ip";
    content = ''
          chain prerouting {
            type nat hook prerouting priority dstnat; policy accept;
            iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
          }
        chain postrouting {
            type nat hook postrouting priority srcnat; policy accept;
            oifname "wg0" masquerade
          }
        '';
      };
  };
  };
  boot.kernel.sysctl = {
    "net.ipv4.ip_forward" = 1;
  };

  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  system.stateVersion = "26.05";
}