Chickadee/hosts/vps/default.nix

{ config, lib, pkgs, ... }:

{
  imports = [
    ./hardware-configuration.nix

    ../../modules/ssh.nix
  ];

  networking.hostName = "vps";

  users.users.lilac = {
    isNormalUser = true;
	group = "lilac";
	extraGroups = [ "wheel" ];
  };
  users.groups.lilac = {};
  home-manager = {
    useGlobalPkgs = true;
    useUserPackages = true;
    users.lilac = import ../../home/lilac.nix;
  };
  programs.zsh.enable = true;
  users.users.lilac.shell = pkgs.zsh;
  security.sudo.wheelNeedsPassword = false;

  # forwarding inbound network traffic over wireguard
  networking = {
    firewall = {
	  enable = true;
	  allowedTCPPorts = [ 80 443 ];
	  allowedUDPPorts = [ 51820 ];
	  trustedInterfaces = [ "wg0" ];
	};
	wireguard.interfaces."wg0" = {
      ips = [ "10.0.0.3/24" ];
	  listenPort = 51820;
	  generatePrivateKeyFile = true;
	  privateKeyFile = "/var/lib/wireguard/wg0.key";
	  peers = [
	    {
		  allowedIPs = [ "10.0.0.1/32" ];
          publicKey = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU=";
		}
		{
          allowedIPs = [ "10.0.0.2/32" ];
		  publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
		}
		{
		  allowedIPs = [ "10.0.0.4/32" ];
		  publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
		}
      ];
	};
	nftables = {
	  enable = true;
	  tables.nat = {
	    family = "ip";
		content = ''
          chain prerouting {
            type nat hook prerouting priority dstnat; policy accept;
            iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
          }
	      chain postrouting {
            type nat hook postrouting priority srcnat; policy accept;
            oifname "wg0" masquerade
          }
        '';
      };
	};
  };
  boot.kernel.sysctl = {
    "net.ipv4.ip_forward" = 1;
  };

  nix.settings.experimental-features = [ "nix-command" "flakes" ];
  system.stateVersion = "26.05";
}