From 5fb951ba3c1ea1c271e094e27fa67e417dac6db2 Mon Sep 17 00:00:00 2001
From: Egor Savkin <es@m-labs.hk>
Date: Wed, 28 Aug 2024 17:25:02 +0800
Subject: [PATCH] WIP: Use gre/ipsec instead of proxy

Signed-off-by: Egor Savkin <es@m-labs.hk>
---
 nixbld-etc-nixos/configuration.nix | 89 +++++++++++++++++++-----------
 1 file changed, 58 insertions(+), 31 deletions(-)

diff --git a/nixbld-etc-nixos/configuration.nix b/nixbld-etc-nixos/configuration.nix
index 9383996..32b1414 100644
--- a/nixbld-etc-nixos/configuration.nix
+++ b/nixbld-etc-nixos/configuration.nix
@@ -260,6 +260,29 @@ in
         }
       ];
     };
+    greTunnels.intl0 = {
+      dev = netifWan;
+      remote = "5.78.16.0";
+      local = "94.190.212.123";
+      ttl = 255;
+      type = "tun";
+    };
+    interfaces.intl0 = {
+      ipv4.addresses = [
+        {
+          address = "10.42.0.2";
+          prefixLength = 30;
+        }
+      ];
+      ipv4.routes = [
+        {
+          address = "0.0.0.0";
+          prefixLength = 0;
+          via = "10.42.0.1";
+          options.table = "3";
+        }
+      ];
+    };
     vlans = {
       "${netifAltVlan}" = {
         id = 2;
@@ -328,6 +351,27 @@ in
       start_action = "start";
     };
   };
+  services.strongswan-swanctl.swanctl.connections.intl = {
+    local_addrs = [ "94.190.212.123" ];
+    remote_addrs = [ "5.78.16.0" ];
+    local.main = {
+      auth = "pubkey";
+      id = "fqdn:m-labs.hk";
+      pubkeys = [ "/etc/swanctl/pubkey/m-labs.hk" ];
+    };
+    remote.main = {
+      auth = "pubkey";
+      id = "fqdn:m-labs-intl.com";
+      pubkeys = [ "/etc/swanctl/pubkey/m-labs-intl.com" ];
+    };
+    children.intl0 = {
+      mode = "transport";
+      ah_proposals = [ "sha256-curve25519" ];
+      remote_ts = [ "5.78.16.0[gre]" ];
+      local_ts = [ "94.190.212.123[gre]" ];
+      start_action = "start";
+    };
+  };
 
   systemd.services.network-custom-route-backup = {
     wantedBy = [ "network.target" ];
@@ -356,6 +400,15 @@ in
       ExecStop = "${pkgs.iproute2}/bin/ip rule del table 1";
     };
   };
+  systemd.services.network-custom-route-intl = {
+    wantedBy = [ "network.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = "${pkgs.iproute2}/bin/ip rule add from 5.78.16.0/32 table 3";
+      ExecStop = "${pkgs.iproute2}/bin/ip rule del table 3";
+    };
+  };
 
   # https://kb.isc.org/docs/dnssec-key-and-signing-policy
   # chown named.named /etc/nixos/named
@@ -1251,20 +1304,9 @@ in
       ExecStart = "${pkgs.bash}/bin/bash -c 'PATH=${pkgs.rt}/bin HOME=/tmp ${pkgs.fetchmail}/bin/fetchmail -f /etc/nixos/secret/rt_fetchmailrc'";
     };
   };
-  systemd.services.ssh-tunnel-intl = {
-      description = "SSH Tunnel to Intl";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "sockets.service" ];
-      serviceConfig = {
-        Restart = "on-failure";
-        User = "hydra-queue-runner"; # TODO needs new user here
-        Group = "hydra";
-        ExecStart = "${pkgs.openssh}/bin/ssh -N -D 127.0.0.1:1587 ssh_tunnel@5.78.86.156";
-      };
-    };
 
   environment.etc."postfix/sender_relay".text = ''
-      m-labs-intl.com socks:
+      m-labs-intl.com smtptun:
       * :
   '';
   systemd.services.postfix-rebuild-sender-relay = {
@@ -1284,28 +1326,13 @@ in
     enablePop3Ssl = true;
     certificateScheme = "acme-nginx";
   } // (import /etc/nixos/secret/email_settings.nix);
-  ssh_proxy_conf = builtins.toFile "proxychains.conf" ''
-      strict_chain
-      tcp_read_time_out 15000
-      tcp_connect_time_out 8000
-      localnet 192.168.1.0/255.255.255.0
-      localnet 127.0.0.0/255.0.0.0
-      localnet ::1/128
-      localnet 94.190.212.123/255.255.255.255
-      localnet 202.77.7.238/255.255.255.255
-      localnet 2001:470:18:390::2/255.255.255.255
-      [ProxyList]
-      socks5 	127.0.0.1 1587
-  '';
   services.postfix = {
     config = {
       sender_dependent_relayhost_maps = "hash:/etc/postfix/sender_relay";
-      postscreen_upstream_proxy_protocol = "haproxy";
-      postscreen_upstream_proxy_timeout = "5s";
-      masterConfig.socks = {
-        type = "unix";
-        command = "pipe";
-        args = "flags=R user=nobody argv=${pkgs.proxychains-ng}/bin/proxychains4 -f ${config.ssh_proxy_conf} ${pkgs.postfix}/bin/sendmail -oi -f $sender $recipient";
+      masterConfig.smtptun = {
+        type = "smtp";
+        command = "smtp";
+        args = "-o smtp_bind_address=10.42.0.2";
       };
     };
   };