WIP: Use gre/ipsec instead of proxy

Signed-off-by: Egor Savkin <es@m-labs.hk>

nixbld-etc-nixos/configuration.nix

@@ -216,6 +216,29 @@ in
         }
       ];
     };
+    greTunnels.intl0 = {
+      dev = netifWan;
+      remote = "5.78.86.156";
+      local = "94.190.212.123";
+      ttl = 255;
+      type = "tun";
+    };
+    interfaces.intl0 = {
+      ipv4.addresses = [
+        {
+          address = "5.78.86.156";
+          prefixLength = 32;
+        }
+      ];
+      ipv4.routes = [
+        {
+          address = "0.0.0.0";
+          prefixLength = 0;
+          via = "5.78.86.156";
+          options.table = "3";
+        }
+      ];
+    };
     vlans = {
       vlan0 = {
         id = 2;
@@ -263,6 +286,27 @@ in
       start_action = "start";
     };
   };
+  services.strongswan-swanctl.swanctl.connections.intl = {
+    local_addrs = [ "94.190.212.123" ];
+    remote_addrs = [ "5.78.86.156" ];
+    local.main = {
+      auth = "pubkey";
+      id = "fqdn:m-labs.hk";
+      pubkeys = [ "/etc/swanctl/pubkey/m-labs.hk" ];
+    };
+    remote.main = {
+      auth = "pubkey";
+      id = "fqdn:m-labs-intl.com";
+      pubkeys = [ "/etc/swanctl/pubkey/m-labs-intl.com" ];
+    };
+    children.intl0 = {
+      mode = "transport";
+      ah_proposals = [ "sha256-curve25519" ];
+      remote_ts = [ "5.78.86.156[gre]" ];
+      local_ts = [ "94.190.212.123[gre]" ];
+      start_action = "start";
+    };
+  };
 
   systemd.services.network-custom-route-backup = {
     wantedBy = [ "network.target" ];
@@ -282,6 +326,15 @@ in
       ExecStop = "${pkgs.iproute2}/bin/ip rule del table 1";
     };
   };
+  systemd.services.network-custom-route-intl = {
+    wantedBy = [ "network.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStart = "${pkgs.iproute2}/bin/ip rule add from 5.78.86.156/32 table 3";
+      ExecStop = "${pkgs.iproute2}/bin/ip rule del table 3";
+    };
+  };
 
   # https://kb.isc.org/docs/dnssec-key-and-signing-policy
   # chown named.named /etc/nixos/named
@@ -1177,6 +1230,18 @@ in
     };
   };
 
+  environment.etc."postfix/sender_relay".text = ''
+      m-labs-intl.com smtptun:
+      * :
+  '';
+  systemd.services.postfix-rebuild-sender-relay = {
+      description = "Postfix Rebuild Sender Dependent Relayhost Maps";
+      serviceConfig = {
+        ExecStart = "${pkgs.postfix}/sbin/postmap /etc/postfix/sender_relay";
+      };
+      wantedBy = [ "multi-user.target" ];
+  };
+
   mailserver = {
     enable = true;
     localDnsResolver = false;  # conflicts with dnsmasq
@@ -1185,8 +1250,17 @@ in
     enablePop3 = true;
     enablePop3Ssl = true;
     certificateScheme = "acme-nginx";
-    policydSPFExtraConfig = "skip_addresses = 5.78.86.156,2a01:4ff:1f0:83de::1";
   } // (import /etc/nixos/secret/email_settings.nix);
+  services.postfix = {
+    config = {
+      sender_dependent_relayhost_maps = "hash:/etc/postfix/sender_relay";
+      masterConfig.smtptun = {
+        type = "smtp";
+        command = "smtp";
+        args = "-o smtp_bind_address=5.78.86.156";
+      };
+    };
+  };
   services.roundcube = {
     enable = true;
     hostName = "mail.m-labs.hk";