What a clusterfuck

modules/system/devices/networking/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  networking = {
+    wireless.enable = false;
+    dhcpcd.enable = true;
+    nftables.enable = true;
+  };
+}

modules/system/devices/networking/firewall/pc/default.nix

@@ -0,0 +1,9 @@
+{ outputs, ... }:
+{
+  networking.firewall = {
+    allowPing = false;
+    extraInputRules = ''
+      ip saddr { ${outputs.ips.server}, ${outputs.ips.wgSpan}.1 } accept comment "Accept Server"
+    '';
+  };
+}

modules/system/devices/networking/firewall/server/default.nix

@@ -0,0 +1,56 @@
+{ outputs, ... }:
+{
+  # Allow forwarding
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
+  # Configure firewall
+  networking = let
+    mailPorts = "{ 25, 143, 465, 587, 993, 4190 }";
+  in {
+    firewall = {
+      allowPing = false;
+  
+      # Add extra input rules using nftables
+      extraInputRules = ''
+        ip saddr { ${outputs.ips.localSpan}.0/24, ${outputs.ips.wgSpan}.0/24 } tcp dport 2049 accept comment "Accept NFS"
+        ip saddr { ${outputs.ips.pc}, ${outputs.secrets.lunaIP}, ${outputs.secrets.cornIP} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
+        ip saddr ${outputs.ips.wgSpan}.3 tcp dport ${mailPorts} accept comment "Accept mail"
+      '';
+    };
+  
+    # Enable nftables and forwarding
+    nftables = {
+      tables = {
+        forwarding = {
+          family = "ip";
+          content = ''
+            chain PREROUTING {
+              type nat hook prerouting priority dstnat; policy accept;
+              tcp dport 2211 dnat to ${outputs.ips.pc}:22 comment "SSH to PC"
+              tcp dport 2233 dnat to ${outputs.ips.wgSpan}.3:22 comment "SSH to Oracle VM"
+              
+              udp dport { 27005, 27015, 7777 } dnat to ${outputs.ips.pc} comment "PC Hosted Games"
+              
+              tcp dport { 58010, 57989, 57984 } dnat to ${outputs.ips.pc} comment "PC Sunshine TCP"
+              udp dport { 57998, 57999, 58000 } dnat to ${outputs.ips.pc} comment "PC Sunshine UDP"
+              
+              tcp dport { 38010, 37989, 37984 } dnat to ${outputs.ips.vm} comment "VM Sunshine TCP"
+              udp dport { 37998, 37999, 38000 } dnat to ${outputs.ips.vm} comment "VM Sunshine UDP"
+              
+              udp dport { 7790, 7791, 7792 } dnat to ${outputs.ips.hx} comment "Deus Ex"
+              
+              ip saddr ${outputs.secrets.cornIP} tcp dport { 9943, 9944 } dnat to ${outputs.ips.vm} comment "VM ALVR TCP"
+              ip saddr ${outputs.secrets.cornIP} udp dport { 9943, 9944 } dnat to ${outputs.ips.vm} comment "VM ALVR UDP"
+            }
+            chain POSTROUTING {
+              type nat hook postrouting priority 100; policy accept;
+              oifname "${outputs.ips.netInt}" masquerade
+	      iifname "${outputs.ips.netInt}" oifname "${outputs.ips.wgInt}" masquerade comment "Traffic from public to WireGuard"
+	      tcp dport ${mailPorts} oifname != "${outputs.ips.wgInt}" drop comment "Send mail"
+            }
+          '';
+        };
+      };
+    };
+  };
+}

modules/system/devices/networking/wireguard/client/default.nix

@@ -0,0 +1,22 @@
+{ outputs, ... }:
+{
+  networking.firewall = {
+    allowedUDPPorts = [ 51820 ];
+  };
+
+  networking.wireguard.interfaces = {
+    "${outputs.ips.wgInt}" = {
+      # Define IP of client in per device config
+      listenPort = 51820;
+      privateKey = outputs.secrets.wgClientPriv;
+      peers = [
+        { # 0.0.0.0 makes wg act like a traditional VPN
+          publicKey = outputs.secrets.wgServerPub;
+          allowedIPs = [ "0.0.0.0/0" ];
+          endpoint = "sv.${outputs.secrets.jimDomain}:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+}

modules/system/devices/networking/wireguard/host/default.nix

@@ -0,0 +1,36 @@
+{ outputs, ... }:
+{
+  networking = {
+    nat = {
+      enable = true;
+      externalInterface = "${outputs.ips.netInt}";
+      internalInterfaces = [ "${outputs.ips.wgInt}" ];
+    };
+    firewall.allowedUDPPorts = [ 51820 ];
+  };
+
+  networking.wireguard = {
+    enable = true;
+    interfaces = {
+      "${outputs.ips.wgInt}" = {
+        ips = [ "${outputs.ips.wgSpan}.1/24" ];
+        listenPort = 51820;
+        privateKey = outputs.secrets.wgServerPriv;
+        peers = [
+          { # Jimbo Pixel 9
+            publicKey = outputs.secrets.wgPixel9Pub;
+            allowedIPs = [ "${outputs.ips.wgSpan}.2/32" ];
+          }
+          { # Oracle VM
+            publicKey = outputs.secrets.wgOraclePub;
+            allowedIPs = [ "${outputs.ips.wgSpan}.3/32" ];
+          }
+          { # General Nix
+            publicKey = outputs.secrets.wgClientPub;
+            allowedIPs = [ "${outputs.ips.wgSpan}.16/28" ];
+          }
+        ];
+      };
+    };
+  };
+}

modules/system/devices/networking/wireless/default.nix

@@ -0,0 +1,7 @@
+{ lib, config, ... }:
+{
+  networking = {
+    wireless.iwd.enable = true;
+    enableB43Firmware = true;
+  };
+}