From 5a408bdb63cb4bce1dc61f63987671c289f86ca6 Mon Sep 17 00:00:00 2001
From: Egor Savkin <es@m-labs.hk>
Date: Fri, 20 Sep 2024 17:36:31 +0800
Subject: [PATCH] Return swan into the zoo

Signed-off-by: Egor Savkin <es@m-labs.hk>
---
 nixbld-etc-nixos/configuration.nix     | 79 ++++++++++++++++++--------
 nixbld-etc-nixos/named/m-labs-intl.com |  2 +-
 2 files changed, 55 insertions(+), 26 deletions(-)

diff --git a/nixbld-etc-nixos/configuration.nix b/nixbld-etc-nixos/configuration.nix
index aab3cd7..d1ada70 100644
--- a/nixbld-etc-nixos/configuration.nix
+++ b/nixbld-etc-nixos/configuration.nix
@@ -91,7 +91,7 @@ in
     hostId = "e423f012";
     firewall = {
       allowedTCPPorts = [ 53 80 443 2222 7402 ];
-      allowedUDPPorts = [ 53 67 500 4500 51820 ];
+      allowedUDPPorts = [ 53 67 500 4500 ];
       trustedInterfaces = [ netifLan ];
       logRefusedConnections = false;
       extraCommands = ''
@@ -260,6 +260,29 @@ in
         }
       ];
     };
+    greTunnels.intl0 = {
+      dev = netifWan;
+      remote = "5.78.16.0";
+      local = "94.190.212.123";
+      ttl = 255;
+      type = "tun";
+    };
+    interfaces.intl0 = {
+      ipv4.addresses = [
+        {
+          address = "5.78.16.0";
+          prefixLength = 32;
+        }
+      ];
+      ipv4.routes = [
+        {
+          address = "0.0.0.0";
+          prefixLength = 0;
+          via = "5.78.16.0";
+          options.table = "3";
+        }
+      ];
+    };
     vlans = {
       "${netifAltVlan}" = {
         id = 2;
@@ -279,30 +302,6 @@ in
         }
       ];
     };
-    wireguard.interfaces = {
-      intl0 = {
-        ips = [ "10.42.0.2/30" ];
-        listenPort = 51820;
-        privateKeyFile = "/path/to/private/key"; # just `wg-quick genkey > /path/to/private/key`
-        postUp = ''
-          ${pkgs.iproute2}/bin/ip rule add from 10.42.0.0/30 lookup 51820
-          ${pkgs.iproute2}/bin/ip route add default via 10.42.0.1 dev intl0 table 51820
-        '';
-        preDown = ''
-          ${pkgs.iproute2}/bin/ip rule del from 10.42.0.0/30 lookup 51820
-          ${pkgs.iproute2}/bin/ip route del default via 10.42.0.1 dev intl0 table 51820
-        '';
-        peers = [
-          {
-            publicKey = "4RozbGZ9ENCjvJXGMB5aK1oqyZfD4UCarEHjSckwVGI=";
-            allowedIPs = [ "0.0.0.0/0" ];
-            allowedIPsAsRoutes = false;
-            endpoint = "2a01:4ff:1f0:83de::1:51820";
-            persistentKeepalive = 25;
-          }
-        ];
-      };
-    };
   };
   boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = "1";
   boot.kernel.sysctl."net.ipv6.conf.default.forwarding" = "1";
@@ -352,6 +351,27 @@ in
       start_action = "start";
     };
   };
+  services.strongswan-swanctl.swanctl.connections.intl = {
+    local_addrs = [ "94.190.212.123" ];
+    remote_addrs = [ "5.78.16.0" ];
+    local.main = {
+      auth = "pubkey";
+      id = "fqdn:m-labs.hk";
+      pubkeys = [ "/etc/swanctl/pubkey/m-labs.hk" ];
+    };
+    remote.main = {
+      auth = "pubkey";
+      id = "fqdn:m-labs-intl.com";
+      pubkeys = [ "/etc/swanctl/pubkey/m-labs-intl.com" ];
+    };
+    children.intl0 = {
+      mode = "transport";
+      ah_proposals = [ "sha256-curve25519" ];
+      remote_ts = [ "5.78.16.0[gre]" ];
+      local_ts = [ "94.190.212.123[gre]" ];
+      start_action = "start";
+    };
+  };
 
   systemd.services.network-custom-route-backup = {
     wantedBy = [ "network.target" ];
@@ -380,6 +400,15 @@ in
       ExecStop = "${pkgs.iproute2}/bin/ip rule del table 1";
     };
   };
+  systemd.services.network-custom-route-intl = {
+    wantedBy = [ "network.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = "${pkgs.iproute2}/bin/ip rule add from 5.78.16.0/32 table 3";
+      ExecStop = "${pkgs.iproute2}/bin/ip rule del table 3";
+    };
+  };
 
   # https://kb.isc.org/docs/dnssec-key-and-signing-policy
   # chown named.named /etc/nixos/named
diff --git a/nixbld-etc-nixos/named/m-labs-intl.com b/nixbld-etc-nixos/named/m-labs-intl.com
index ac71b52..fdb5510 100644
--- a/nixbld-etc-nixos/named/m-labs-intl.com
+++ b/nixbld-etc-nixos/named/m-labs-intl.com
@@ -22,7 +22,7 @@ $TTL 7200
 ns						A		94.190.212.123
 ns						AAAA	2001:470:18:390::2
 
-mail					A		5.78.86.156
+mail					A		5.78.16.0
 mail._domainkey			IN	TXT	"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJVPuhSGXghO7ib8Em/Se3jfCCIJK5g4zn5pGZ3/e0I0f+zGHMuvwpjkAKf6eSmo/AAXEaco28pDi3qE5xfV512AJsORCfPoPFyNhLsj/qtri6hc5KVSWW0Ja3MSFBINDCaX78c7PXPY+3jJJGpwSBDLjdxj9AQwtfiCVlH4qE/QIDAQAB"
 _dmarc					TXT		"v=DMARC1; p=none"