From 47c7a0bc35761793feea4f2c16d741f1073546a5 Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Thu, 30 Jul 2026 16:39:44 +0200
Subject: wip: disable ipv6 fw on interfaces other than wg0

---
 hosts/sagittarius/network.nix | 3 +++
 wireguard.nix                 | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/hosts/sagittarius/network.nix b/hosts/sagittarius/network.nix
index d201590..8d21275 100644
--- a/hosts/sagittarius/network.nix
+++ b/hosts/sagittarius/network.nix
@@ -64,6 +64,9 @@
         networkConfig.DHCP = "ipv4";
         address = [ "2a01:4f9:c012:c7a7::1/64" ];
         routes = [ { Gateway = "fe80::1"; } ];
+        # networkConfig = {
+        #   IPv6Forwarding = false;
+        # };
       };
     };
   };
diff --git a/wireguard.nix b/wireguard.nix
index 278ae0c..20307a1 100644
--- a/wireguard.nix
+++ b/wireguard.nix
@@ -102,6 +102,6 @@ in
   boot.kernel.sysctl = lib.mkIf isHub {
     # I *think* this should be fine since networkd will prevent forwarding
     # on any interface that doesn't have IPv6Forwarding set to true.
-    "net.ipv6.conf.all.forwarding" = true;
+    "net.ipv6.conf.wg0.forwarding" = true;
   };
 }
-- 
cgit v1.3.1