nyaan: set up tailscale client

1 files changed, 9 insertions, 48 deletions

diff --git a/hosts/nyaan/network.nix b/hosts/nyaan/network.nix
index 347a802..bacff5a 100644
--- a/hosts/nyaan/network.nix
+++ b/hosts/nyaan/network.nix
@@ -1,14 +1,11 @@
 {
   config,
-  flakeRoot,
   ...
 }:
 let
   secrets = config.sops.secrets;
 in
 {
-  imports = [ (flakeRoot + /wireguard.nix) ];
-
   sops = {
     age.keyFile = "/var/lib/sops-nix/key.txt";
     secrets."wireless.env" = {
@@ -21,54 +18,18 @@ in
   networking = {
     hostName = "nyaan";
     useNetworkd = true;
-    firewall.enable = false;
-    nftables = {
-      enable = true;
-      tables.filter = {
-        enable = true;
-        family = "inet";
-        content = ''
-          	set temp-ports {
-              type inet_proto . inet_service
-              flags interval
-              comment "Temporarily opened ports"
-            }
-
-          	chain rpfilter {
-              type filter hook prerouting priority mangle + 10; policy drop;
-              meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
-              fib saddr . mark . iif check exists accept
-              jump rpfilter-allow
-            }
-
-            chain rpfilter-allow {
-            }
-
-            chain prerouting {
-              type filter hook prerouting priority mangle;
-              iifname "wg0" meta mark set 42
-            }
-
-            chain input {
-              type filter hook input priority filter; policy drop;
-              iifname "lo" accept comment "trusted interfaces"
-              icmpv6 type echo-reply accept
-              ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow }
-            }
-
-            chain input-allow {
-              # tcp dport { 22, 80, 443 } accept
-              udp dport 51820 accept
-              meta l4proto . th dport @temp-ports accept
-              icmp type echo-request accept comment "allow ping"
-              icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139).  See RFC 4890, section 4.4."
-              ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"
-            }
-        '';
-      };
+    firewall = {
+      checkReversePath = "loose";
+      trustedInterfaces = [ "tailscale0" ];
+      allowedUDPPorts = [ config.services.tailscale.port ];
     };
   };
 
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;
+  };
+
   networking.wireless.iwd-ext = {
     enable = true;
     secretsEnvFile = secrets."wireless.env".path;