Fix WireGuard nat rules

config/hosts/lifeline/configuration.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ pkgs, ... }:
 {
   boot.loader.grub = {
     enable = true;
@@ -14,6 +14,43 @@
       enable = true;
       allowedUDPPorts = [ 51820 ];
     };
+    # mail-2 VPN
+    wireguard = {
+      enable = true;
+      interfaces.wg0 = {
+        listenPort = 51820;
+        ips = [
+          "172.16.50.1/24"
+        ];
+        peers = [
+          {
+            name = "mail-2";
+            publicKey = "OIBOJlFzzM3P/u1ftVW2HWt8kA6NveB4PaBOIXhCYhM=";
+            presharedKeyFile = "/secrets/wireguard-lifeline-mail-2-lifeline-psk.secret";
+            allowedIPs = [ "172.16.50.2/32" ];
+          }
+        ];
+        postSetup = ''
+          ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
+          ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 172.16.50.0/24 -o ens6 -j MASQUERADE
+        '';
+        postShutdown = ''
+          ${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
+          ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 172.16.50.0/24 -o ens6 -j MASQUERADE
+        '';
+        privateKeyFile = "/secrets/wireguard-lifeline-wg0-privatekey.secret";
+      };
+    };
+    nat = {
+      enable = true;
+      internalInterfaces = [ "wg0" ];
+      externalInterface = "ens6";
+      forwardPorts = [{
+          destination = "172.16.50.2:25";
+          proto = "tcp";
+          sourcePort = 25;
+      }];
+    };
   };
 
   services.prometheus.exporters.node.enable = false;

config/hosts/lifeline/secrets.nix

@@ -1,15 +1,15 @@
 { ... }:
 {
-  deployment.keys."wireguard-lifeline-mail-1-lifeline-psk.secret" = {
+  deployment.keys."wireguard-lifeline-wg0-privatekey.secret" = {
-    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/lifeline-mail-1/psk" ];
+    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/lifeline-wg0-privatekey" ];
     destDir = "/secrets";
     user = "root";
     group = "root";
     permissions = "0640";
     uploadAt = "pre-activation";
   };
-  deployment.keys."wireguard-lifeline-mail-1-lifeline-privatekey.secret" = {
+  deployment.keys."wireguard-lifeline-mail-2-lifeline-psk.secret" = {
-    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/lifeline-mail-1/lifeline-privatekey" ];
+    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/lifeline-mail-2/psk" ];
     destDir = "/secrets";
     user = "root";
     group = "root";

config/hosts/mail-1/configuration.nix

@@ -1,61 +1,91 @@
-{ hosts, ... }:
+{ pkgs, ... }:
 {
   boot.loader.grub = {
     enable = true;
     device = "/dev/vda";
   };
 
-  networking = {
+  systemd.network = {
-    hostName = "mail-1";
+    enable = true;
-    useDHCP = true;
+    networks = {
-    defaultGateway = {
+      "enp6s18" = {
-      address = "172.16.50.1";
+        matchConfig.Name = "enp6s18";
-      interface = "wg0";
+        address = [
-    };
+          "10.202.41.123/24"
-    interfaces.enp6s18.ipv4 = {
-      routes = [
-        {
-          address = "10.201.0.0";
-          prefixLength = 16;
-          via = "10.202.41.1";
-        }
-        {
-          address = "10.202.0.0";
-          prefixLength = 16;
-          via = "10.202.41.1";
-        }
-        {
-          address = "172.21.87.0"; # management VPN
-          prefixLength = 24;
-          via = "10.202.41.1";
-        }
-        {
-          address = "212.53.203.19"; # valkyrie.af.grzb.de
-          prefixLength = 32;
-          via = "10.202.41.1";
-        }
-      ];
-    };
-    wireguard = {
-      enable = true;
-      interfaces.wg0 = {
-        ips = [
-          "172.16.50.2/24"
         ];
-        peers = [
+        routes = [
           {
-            name = "valkyrie";
+            routeConfig = {
-            publicKey = "ik480irMZtGBs1AFpf1KGzDBekjdziD3ck7XK8r1WXQ=";
+              Gateway = "10.202.41.1";
-            presharedKeyFile = "/secrets/wireguard-valkyrie-mail-1-mail-1-psk.secret";
+              Destination = "10.201.0.0/16";
-            endpoint = "212.53.203.19:51822";
+            };
-            allowedIPs = [ "0.0.0.0/0" ];
+          }
-            persistentKeepalive = 25;
+          {
+            routeConfig = {
+              Gateway = "10.202.41.1";
+              Destination = "10.202.0.0/16";
+            };
+          }
+          {
+            routeConfig = {
+              Gateway = "10.202.41.1";
+              Destination = "172.21.87.0/24";
+            };
+          }
+          {
+            routeConfig = {
+              Gateway = "10.202.41.1";
+              Destination = "212.53.203.19/32";
+            };
           }
         ];
-        privateKeyFile = "/secrets/wireguard-mail-1-wg0-privatekey.secret";
+        linkConfig.RequiredForOnline = "routable";
+      };
+      "wg0" = {
+        matchConfig.Name = "wg0";
+        address = [
+          "172.16.50.2/24"
+        ];
+        DHCP = "no";
+        gateway = [
+          "172.16.50.1"
+        ];
+      };
+    };
+    netdevs = {
+      "wg0" = {
+        netdevConfig = {
+          Kind = "wireguard";
+          Name = "wg0";
+        };
+        wireguardConfig = {
+          PrivateKeyFile = "/secrets/wireguard-mail-1-wg0-privatekey.secret";
+        };
+        wireguardPeers = [{
+          wireguardPeerConfig = {
+            PublicKey = "ik480irMZtGBs1AFpf1KGzDBekjdziD3ck7XK8r1WXQ=";
+            PresharedKeyFile = "/secrets/wireguard-valkyrie-mail-1-mail-1-psk.secret";
+            Endpoint = "212.53.203.19:51822";
+            AllowedIPs = [ "0.0.0.0/0" ];
+            PersistentKeepalive = 25;
+          };
+        }];
       };
     };
   };
 
+  networking = {
+    hostName = "mail-1";
+    useDHCP = false;
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 25 465 993 ];
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    wireguard-tools
+  ];
+
   system.stateVersion = "23.05";
 }

config/hosts/mail-1/simple-nixos-mailserver.nix

@@ -59,8 +59,11 @@
 
   services.postfix = {
     transport = "relay:[mail-2.grzb.de]";
+<<<<<<< HEAD
     extraConfig = ''
       proxy_interfaces = 212.53.203.19
     '';
+=======
+>>>>>>> 0e55e66 (Use systemd-networkd on mail servers)
   };
 }

config/hosts/mail-2/configuration.nix

@@ -0,0 +1,91 @@
+{ pkgs, ... }:
+{
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/vda";
+  };
+
+  systemd.network = {
+    enable = true;
+    networks = {
+      "enp6s18" = {
+        matchConfig.Name = "enp6s18";
+        address = [
+          "10.201.41.100/24"
+        ];
+        routes = [
+          {
+            routeConfig = {
+              Gateway = "10.201.41.1";
+              Destination = "10.201.0.0/16";
+            };
+          }
+          {
+            routeConfig = {
+              Gateway = "10.201.41.1";
+              Destination = "10.202.0.0/16";
+            };
+          }
+          {
+            routeConfig = {
+              Gateway = "10.201.41.1";
+              Destination = "172.21.87.0/24";
+            };
+          }
+          {
+            routeConfig = {
+              Gateway = "10.201.41.1";
+              Destination = "217.160.117.160/32";
+            };
+          }
+        ];
+        linkConfig.RequiredForOnline = "routable";
+      };
+      "wg0" = {
+        matchConfig.Name = "wg0";
+        address = [
+          "172.16.50.2/24"
+        ];
+        DHCP = "no";
+        gateway = [
+          "172.16.50.1"
+        ];
+      };
+    };
+    netdevs = {
+      "wg0" = {
+        netdevConfig = {
+          Kind = "wireguard";
+          Name = "wg0";
+        };
+        wireguardConfig = {
+          PrivateKeyFile = "/secrets/wireguard-mail-2-wg0-privatekey.secret";
+        };
+        wireguardPeers = [{
+          wireguardPeerConfig = {
+            PublicKey = "Nnf7x+Yd+l8ZkK2BTq1lK3iiTYgdrgL9PQ/je8smug4=";
+            PresharedKeyFile = "/secrets/wireguard-lifeline-mail-2-mail-2-psk.secret";
+            Endpoint = "217.160.117.160:51820";
+            AllowedIPs = [ "0.0.0.0/0" ];
+            PersistentKeepalive = 25;
+          };
+        }];
+      };
+    };
+  };
+
+  networking = {
+    hostName = "mail-2";
+    useDHCP = false;
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 25 ];
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    wireguard-tools
+  ];
+
+  system.stateVersion = "23.05";
+}

config/hosts/mail-2/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+{
+  imports = [
+    ./configuration.nix
+    ./postfix.nix
+  ];
+}

config/hosts/mail-2/postfix.nix

@@ -0,0 +1,17 @@
+{ ... }: {
+  # Postfix relay configuration, see: https://www.postfix.org/STANDARD_CONFIGURATION_README.html#backup
+  services.postfix = {
+    enable = true;
+    hostname = "mail-2.grzb.de";
+    relayDomains = [
+      "grzb.de"
+      "nekover.se"
+    ];
+    extraConfig = ''
+      message_size_limit = 20971520
+      smtpd_relay_restrictions = permit_mynetworks reject_unauth_destination
+      proxy_interfaces = 217.160.117.160
+      relay_recipient_maps =
+    '';
+  };
+}

config/hosts/mail-2/secrets.nix

@@ -0,0 +1,19 @@
+{ ... }:
+{
+  deployment.keys."wireguard-mail-2-wg0-privatekey.secret" = {
+    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/mail-2-wg0-privatekey" ];
+    destDir = "/secrets";
+    user = "root";
+    group = "systemd-network";
+    permissions = "0640";
+    uploadAt = "pre-activation";
+  };
+  deployment.keys."wireguard-lifeline-mail-2-mail-2-psk.secret" = {
+    keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/lifeline-mail-2/psk" ];
+    destDir = "/secrets";
+    user = "root";
+    group = "systemd-network";
+    permissions = "0640";
+    uploadAt = "pre-activation";
+  };
+}

config/hosts/valkyrie/configuration.nix

@@ -35,7 +35,7 @@
               allowedIPs = [ "10.203.10.2/32" "10.202.0.0/16" ];
             }
             {
-              name = "site2-jsts";
+              name = "site1-jsts";
               publicKey = "u9h+D8XZ62ABnetBRKnf6tjs+tJwM8fQ4d6ipOCLFyE=";
               presharedKeyFile = "/secrets/wireguard-valkyrie-site1-jsts-psk.secret";
               endpoint = "site1.jsts.xyz:51823";
@@ -59,12 +59,12 @@
             }
           ];
           postSetup = ''
-            ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
+            ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -j ACCEPT
-            ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 172.16.50.0/24 -o ens6 -j MASQUERADE
+            ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 172.16.50.0/24 -o ens3 -j MASQUERADE
           '';
           postShutdown = ''
-            ${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
+            ${pkgs.iptables}/bin/iptables -D FORWARD -i wg1 -j ACCEPT
-            ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 172.16.50.0/24 -o ens6 -j MASQUERADE
+            ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 172.16.50.0/24 -o ens3 -j MASQUERADE
           '';
           privateKeyFile = "/secrets/wireguard-valkyrie-wg1-privatekey.secret";
         };

flake.lock

@@ -70,11 +70,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1694493899,
+        "lastModified": 1695011647,
-        "narHash": "sha256-46zEnn7H/G2ne735wEEKKW+LoyPa6NOWj2P9InxDfJs=",
+        "narHash": "sha256-A0iKkey2LBlKCvwMR0HDXSs7ubdFP3ly8YE3m2zS/L4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c5167858ca4870e933da123762eb55363ccefe2b",
+        "rev": "4d2bff6897a5434eef9bd958c7e89c96dec569e0",
         "type": "github"
       },
       "original": {
@@ -116,11 +116,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1694502577,
+        "lastModified": 1694928810,
-        "narHash": "sha256-MMW8BMlRU38Zewova/BOYy3ER+GM2nPln+UYeHI9EsI=",
+        "narHash": "sha256-M/3+pRQmM+FeBeSKRp0b01pncbNiiC2ggJE4Wpi7c1Q=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "55ec5ae7d6c3f7866a0696a6ccfb66a1665b3d72",
+        "rev": "948e8754755a9f27587d5bd109af2cfad313add8",
         "type": "github"
       },
       "original": {

hosts.nix

@@ -53,6 +53,10 @@ in
       site = "vs";
       environment = "proxmox";
     };
+    mail-2 = {
+      site = "wg";
+      environment = "proxmox";
+    };
     matrix = {
       site = "vs";
       environment = "proxmox";