Migrate gateway

modules/nixos/system/network/wireguard/default.nix

@@ -1,4 +1,5 @@
 { config, lib, ... }: {
+  imports = [ ./forwarding.nix ];
   config = lib.mkIf (config.syscfg.net.wg.enable) {
     networking.wireguard = {
       enable = true;
@@ -9,12 +10,19 @@
             config.sops.secrets."${config.syscfg.hostname}_wg_priv".path;
           listenPort = 1515;
           mtu = 1340;
-          peers = [{
-            allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
-            endpoint = "vpn.helcel.net:1515";
-            publicKey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
-            persistentKeepalive = 30;
-          }];
+          peers = 
+            if config.syscfg.net.wg.server.enable then
+              map(secretName:{
+                allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
+                publicKey = config.sops.secrets."${secretName}_wg_pub".path;
+              }) config.syscfg.net.wg.server.peers
+            else
+              [{
+                allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
+                endpoint = "vpn.helcel.net:1515";
+                publicKey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
+                persistentKeepalive = 30;
+              }];
         };
       };
     };

modules/nixos/system/network/wireguard/forwarding.nix

@@ -0,0 +1,43 @@
+
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.syscfg.net.wg;
+
+in
+{
+  
+  config = lib.mkIf (config.syscfg.net.wg.server.enable) {
+    boot.kernel.sysctl = {
+      "net.ipv4.ip_forward" = 1;
+      "net.ipv6.conf.all.forwarding" = 1;
+    };
+
+    networking.nftables.enable = true;
+    networking.nftables.ruleset = ''
+      table inet nat {
+        chain prerouting {
+          type nat hook prerouting priority 0; policy accept;
+          
+          ${concatMapStringsSep "\n" (ports:
+            let
+              src = builtins.elemAt ports 0;
+              dst = builtins.elemAt ports 1;
+            in ''
+              iifname "${cfg.inInterface}" tcp dport ${toString src} counter dnat to ${cfg.toAddr}:${toString dst}
+              iifname "${cfg.inInterface}" udp dport ${toString src} counter dnat to ${cfg.toAddr}:${toString dst}
+            ''
+          ) cfg.forwarding.ports}
+        }
+        
+        chain postrouting {
+          type nat hook postrouting priority 100; policy accept;
+          oifname { "wg0", "ens3" } masquerade
+        }
+      }
+    '';
+  };
+}