From 367d5a8c4cca636dd568133eaf7ebb942021db11 Mon Sep 17 00:00:00 2001
From: Egor Savkin <es@m-labs.hk>
Date: Mon, 9 Sep 2024 14:04:33 +0800
Subject: [PATCH] Use wireguard instead of strongswan since its in the kernel

Signed-off-by: Egor Savkin <es@m-labs.hk>
---
 nixbld-etc-nixos/configuration.nix | 70 +++++++-----------------------
 1 file changed, 16 insertions(+), 54 deletions(-)

diff --git a/nixbld-etc-nixos/configuration.nix b/nixbld-etc-nixos/configuration.nix
index 32b1414..395e856 100644
--- a/nixbld-etc-nixos/configuration.nix
+++ b/nixbld-etc-nixos/configuration.nix
@@ -91,7 +91,7 @@ in
     hostId = "e423f012";
     firewall = {
       allowedTCPPorts = [ 53 80 443 2222 7402 ];
-      allowedUDPPorts = [ 53 67 500 4500 ];
+      allowedUDPPorts = [ 53 67 500 4500 51820 ];
       trustedInterfaces = [ netifLan ];
       logRefusedConnections = false;
       extraCommands = ''
@@ -260,29 +260,6 @@ in
         }
       ];
     };
-    greTunnels.intl0 = {
-      dev = netifWan;
-      remote = "5.78.16.0";
-      local = "94.190.212.123";
-      ttl = 255;
-      type = "tun";
-    };
-    interfaces.intl0 = {
-      ipv4.addresses = [
-        {
-          address = "10.42.0.2";
-          prefixLength = 30;
-        }
-      ];
-      ipv4.routes = [
-        {
-          address = "0.0.0.0";
-          prefixLength = 0;
-          via = "10.42.0.1";
-          options.table = "3";
-        }
-      ];
-    };
     vlans = {
       "${netifAltVlan}" = {
         id = 2;
@@ -302,6 +279,21 @@ in
         }
       ];
     };
+    wireguard.interfaces = {
+      intl0 = {
+        ips = [ "10.42.0.2/32" ];
+        listenPort = 51820;
+        privateKeyFile = "/path/to/private/key";
+        peers = [
+          {
+            publicKey = "4RozbGZ9ENCjvJXGMB5aK1oqyZfD4UCarEHjSckwVGI=";
+            allowedIPs = [ "0.0.0.0/0" ];
+            endpoint = "5.78.86.156:51820";
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+    };
   };
   boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = "1";
   boot.kernel.sysctl."net.ipv6.conf.default.forwarding" = "1";
@@ -351,27 +343,6 @@ in
       start_action = "start";
     };
   };
-  services.strongswan-swanctl.swanctl.connections.intl = {
-    local_addrs = [ "94.190.212.123" ];
-    remote_addrs = [ "5.78.16.0" ];
-    local.main = {
-      auth = "pubkey";
-      id = "fqdn:m-labs.hk";
-      pubkeys = [ "/etc/swanctl/pubkey/m-labs.hk" ];
-    };
-    remote.main = {
-      auth = "pubkey";
-      id = "fqdn:m-labs-intl.com";
-      pubkeys = [ "/etc/swanctl/pubkey/m-labs-intl.com" ];
-    };
-    children.intl0 = {
-      mode = "transport";
-      ah_proposals = [ "sha256-curve25519" ];
-      remote_ts = [ "5.78.16.0[gre]" ];
-      local_ts = [ "94.190.212.123[gre]" ];
-      start_action = "start";
-    };
-  };
 
   systemd.services.network-custom-route-backup = {
     wantedBy = [ "network.target" ];
@@ -400,15 +371,6 @@ in
       ExecStop = "${pkgs.iproute2}/bin/ip rule del table 1";
     };
   };
-  systemd.services.network-custom-route-intl = {
-    wantedBy = [ "network.target" ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStart = "${pkgs.iproute2}/bin/ip rule add from 5.78.16.0/32 table 3";
-      ExecStop = "${pkgs.iproute2}/bin/ip rule del table 3";
-    };
-  };
 
   # https://kb.isc.org/docs/dnssec-key-and-signing-policy
   # chown named.named /etc/nixos/named