chore(os): drop wireguard

2 files changed, 34 insertions, 70 deletions

diff --git a/os/cez/modules/headscale.nix b/os/cez/modules/headscale.nix
index fc465d8..169ed45 100644
--- a/os/cez/modules/headscale.nix
+++ b/os/cez/modules/headscale.nix
@@ -1,9 +1,38 @@
-{ config, ... }:
+{ config, pkgs, ... }:
 let
   headScaleUrl = "https://headscale.${config.global.userdata.domain}";
+  user = config.global.userdata.name;
+
+  exitNode = "kay";
+  helper = pkgs.writeShellApplication {
+    name = "vpn";
+    runtimeInputs = with pkgs; [
+      libnotify
+      tailscale
+      jq
+    ];
+
+    text = ''
+      note() {
+        command -v notify-send >/dev/null &&
+          notify-send "󰒒  Headscale" "$1"
+
+        printf "\n%s\n" "$1"
+      }
+
+      if [ "$(tailscale status --peers --json | jq ".ExitNodeStatus")" = "null" ]; then
+        tailscale set --exit-node=${exitNode} &&
+          note "Now routing all traffic through ${exitNode}"
+      else
+        tailscale set --exit-node= &&
+          note "Traffic now uses default route."
+      fi
+    '';
+  };
 in
 {
   sops.secrets."misc/headscale" = { };
+  environment.systemPackages = [ helper ];
   networking.firewall.trustedInterfaces = [ config.services.tailscale.interfaceName ];
 
   services.tailscale = {
@@ -14,7 +43,10 @@ in
     authKeyFile = config.sops.secrets."misc/headscale".path;
     extraUpFlags = [
       "--login-server=${headScaleUrl}"
-      "--accept-routes"
+    ];
+    extraSetFlags = [
+      "--operator=${user}"
+      "--accept-routes=true"
     ];
   };
 }
diff --git a/os/cez/modules/wireguard.nix b/os/cez/modules/wireguard.nix
deleted file mode 100644
index 5e17293..0000000
--- a/os/cez/modules/wireguard.nix
+++ /dev/null
@@ -1,68 +0,0 @@
-{ config, pkgs, ... }:
-let
-  domain = config.global.userdata.domain;
-  wgIface = "kay";
-
-  helper = pkgs.writeShellApplication {
-    name = "vpn";
-    text = ''
-      note() {
-              command -v notify-send > /dev/null &&
-                      notify-send "󰒒  VPN" "$1"
-
-              printf "\n%s\n" "$1"
-      }
-
-      if systemctl status "wg-quick-${wgIface}.service" > /dev/null 2>&1; then
-              sudo -A systemctl stop "wg-quick-${wgIface}.service" &&
-                      note "connection was dropped"
-      else
-              sudo -A systemctl start "wg-quick-${wgIface}.service" &&
-                      note "traffic routed through ${wgIface}"
-      fi
-    '';
-  };
-in
-{
-  sops.secrets."misc/wireguard" = { };
-  environment.systemPackages = [ helper ];
-
-  networking.wg-quick.interfaces = {
-    ${wgIface} = {
-      autostart = false;
-      address = [ "10.0.1.2/24" ];
-      dns = [ "10.0.1.1" ];
-      mtu = 1412;
-      privateKeyFile = config.sops.secrets."misc/wireguard".path;
-
-      peers = [
-        {
-          publicKey = "wJMyQDXmZO4MjYRk6NK4+J6ZKWLTTZygAH+OwbPjOiw=";
-          allowedIPs = [
-            "10.0.1.0/24"
-            "104.16.0.0/12"
-            "172.64.0.0/13"
-          ];
-          endpoint = "${domain}:51820";
-          persistentKeepalive = 25;
-        }
-      ];
-    };
-
-    bud = {
-      autostart = true;
-      address = [ "10.54.132.2/24" ];
-      mtu = 1420;
-      privateKeyFile = config.sops.secrets."misc/wireguard".path;
-
-      peers = [
-        {
-          publicKey = "O2GRMEWf22YRGKexHAdg1fitucTZ/U/om2MWEJMeyFQ=";
-          allowedIPs = [ "10.54.132.0/24" ];
-          endpoint = "primary.k8s.bud.studio:51820";
-          persistentKeepalive = 25;
-        }
-      ];
-    };
-  };
-}