Chickadee/hosts/vps.nix

{ config, lib, pkgs, ... }:

{
  imports = [
    ../modules/ssh.nix
    ../lilac.nix
  ];

  networking = {
    hostName = "vps";
    
    firewall = {
      enable = true;
      allowedTCPPorts = [ 80 443 ];
      allowedUDPPorts = [ 51820 ];
      trustedInterfaces = [ "wg0" ];
    };

    wireguard.interfaces."wg0" = {
      ips = [ "10.0.0.3/32" ];
      listenPort = 51820;
      generatePrivateKeyFile = true;
      privateKeyFile = "/var/lib/wireguard/wg0.key";
      peers = [
        {
          allowedIPs = [ "10.0.0.1/32" ];
          publicKey = "guKFJGQW946HXWjca/biMYH1nJKw0fguLjzGXKZ7Bxw=";
        }
        {
          allowedIPs = [ "10.0.0.2/32" ];
          publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
        }
        {
          allowedIPs = [ "10.0.0.4/32" ];
          publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
        }
      ];
    };

    nftables = {
      enable = true;
      tables.nat = {
        family = "ip";
        content = ''
          chain prerouting {
            type nat hook prerouting priority dstnat; policy accept;
            iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
          }
          chain postrouting {
            type nat hook postrouting priority srcnat; policy accept;
            oifname "wg0" masquerade
          }
        '';
      };
    };
  };

  boot.kernel.sysctl = {
    "net.ipv4.ip_forward" = 1;
  };

  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  system.stateVersion = "26.05";

  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
  boot.kernelModules = [ ];
  boot.extraModulePackages = [ ];
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.loader.efi.efiSysMountPoint = "/boot/efi";

  fileSystems."/" = {
    device = "/dev/vda2";
    fsType = "ext4";
  };
  fileSystems."/boot/efi" = {
    device = "/dev/vda1";
    fsType = "vfat";
  };
  swapDevices = [ ];

  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
  virtualisation.hypervGuest.enable = true;
}