Add haproxy/mmproxy combo

Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>

hosts/jupiter-vps/configs/haproxy/default.nix

@@ -0,0 +1,26 @@
+{ ... }:
+{
+  # TODO: Some way to automatically configure?
+  services.haproxy = {
+    enable = true;
+    config = ''
+      global
+        maxconn 4096
+
+      defaults
+        mode tcp
+        timeout connect 5s
+        timeout client 30s
+        timeout server 30s
+
+      frontend http
+        bind *:80
+        bind *:443
+        default_backend main
+
+      backend main
+        server jupiter 10.0.0.2:80 send-proxy-v2
+        server jupiter_ssl 10.0.0.2:443 send-proxy-v2
+    '';
+  };
+}

hosts/jupiter-vps/configs/wireguard/default.nix

@@ -1,12 +1,6 @@
-{
+{ config, inputs, ... }:
-  config,
-  inputs,
-  pkgs,
-  ...
-}:
 let
   jupiterConfig = inputs.self.nixosConfigurations.jupiter.config;
-  publicInterface = "ens3";
   wireguardPort = 51820;
 in
 {
@@ -20,33 +14,11 @@ in
       allowedUDPPorts = [ wireguardPort ] ++ jupiterConfig.networking.firewall.allowedUDPPorts;
     };
 
-    wireguard.interfaces.wg0 =
+    wireguard.interfaces.wg0 = {
-      let
-        iptables = "${pkgs.iptables}/bin/iptables";
-      in
-      rec {
       ips = [ "10.0.0.1/24" ];
       listenPort = wireguardPort;
       privateKeyFile = config.sops.secrets."wireguard".path;
 
-        postSetup = [
-          "${iptables} -t nat -A PREROUTING -i ${publicInterface} -p tcp --dport ${builtins.toString (builtins.elemAt config.services.openssh.ports 0)} -j RETURN"
-          "${iptables} -t nat -A PREROUTING -i ${publicInterface} -p udp --dport ${builtins.toString listenPort} -j RETURN"
-          "${iptables} -t nat -A PREROUTING -i ${publicInterface} -j DNAT --to-destination 10.0.0.2"
-          "${iptables} -t nat -A POSTROUTING -d 10.0.0.2 -p tcp --dport ${builtins.toString (builtins.elemAt config.services.openssh.ports 0)} -j RETURN"
-          "${iptables} -t nat -A POSTROUTING -d 10.0.0.2 -p udp --dport ${builtins.toString listenPort} -j RETURN"
-          "${iptables} -t nat -A POSTROUTING -d 10.0.0.2 -j SNAT --to-source 10.0.0.1"
-        ];
-
-        postShutdown = [
-          "${iptables} -t nat -D PREROUTING -i ${publicInterface} -p tcp --dport ${builtins.toString (builtins.elemAt config.services.openssh.ports 0)} -j RETURN"
-          "${iptables} -t nat -D PREROUTING -i ${publicInterface} -p udp --dport ${builtins.toString listenPort} -j RETURN"
-          "${iptables} -t nat -D PREROUTING -i ${publicInterface} -j DNAT --to-destination 10.0.0.2"
-          "${iptables} -t nat -D POSTROUTING -d 10.0.0.2 -p tcp --dport ${builtins.toString (builtins.elemAt config.services.openssh.ports 0)} -j RETURN"
-          "${iptables} -t nat -D POSTROUTING -d 10.0.0.2 -p udp --dport ${builtins.toString listenPort} -j RETURN"
-          "${iptables} -t nat -D POSTROUTING -d 10.0.0.2 -j SNAT --to-source 10.0.0.1"
-        ];
-
       peers = [
         {
           name = "jupiter";

hosts/jupiter-vps/default.nix

@@ -7,6 +7,7 @@
     ./hardware
 
     ../common/configs/system/impermanence
+    ../common/configs/system/neovim
     ../common/configs/system/nix
     ../common/configs/system/nixpkgs
     ../common/configs/system/sops
@@ -16,6 +17,7 @@
     ../common/configs/system/zsh
 
     ./configs/boot
+    ./configs/haproxy
     ./configs/sshd
     ./configs/wireguard
   ];

hosts/jupiter/configs/mmproxy/default.nix

@@ -0,0 +1,42 @@
+{
+  inputs,
+  system,
+  pkgs,
+  ...
+}:
+let
+  selfPkgs = inputs.self.packages.${system};
+in
+{
+  environment.systemPackages = [ selfPkgs.go-mmproxy ];
+
+  boot.kernel.sysctl."net.ipv4.conf.all.route_localnet" = 1;
+
+  networking = {
+    iproute2 = {
+      enable = true;
+      rttablesExtraConfig = ''
+        100 mmproxy
+      '';
+    };
+
+    localCommands =
+      let
+        ip = "${pkgs.iproute2}/bin/ip";
+        iptables = "${pkgs.iptables}/bin/iptables";
+      in
+      ''
+        ${iptables} -t mangle -D PREROUTING -m mark --mark 100 -m comment --comment mmproxy -j CONNMARK --save-mark || true
+        ${iptables} -t mangle -I PREROUTING -m mark --mark 100 -m comment --comment mmproxy -j CONNMARK --save-mark
+
+        ${iptables} -t mangle -D OUTPUT -m connmark --mark 100 -m comment --comment mmproxy -j CONNMARK --restore-mark || true
+        ${iptables} -t mangle -I OUTPUT -m connmark --mark 100 -m comment --comment mmproxy -j CONNMARK --restore-mark
+
+        ${ip} rule del fwmark 100 lookup 100 || true
+        ${ip} rule add fwmark 100 lookup 100
+
+        ${ip} route del local 0.0.0.0/0 dev lo table 100 || true
+        ${ip} route add local 0.0.0.0/0 dev lo table 100
+      '';
+  };
+}

hosts/jupiter/default.nix

@@ -26,6 +26,7 @@
     ../common/configs/system/users
     ../common/configs/system/zsh
 
+    ./configs/mmproxy
     ./configs/wireguard
 
     ./users/storm

packages/default.nix

@@ -9,6 +9,8 @@
   darktable-hald-clut = import ./darktable/hald-clut { inherit pkgs; };
   darktable-lua-scripts = import ./darktable/lua-scripts { inherit pkgs; };
 
+  go-mmproxy = import ./go-mmproxy { inherit pkgs; };
+
   obsidian-plugin-better-word-count = import ./obsidian/plugins/better-word-count { inherit pkgs; };
   obsidian-plugin-dataview = import ./obsidian/plugins/dataview { inherit pkgs; };
   obsidian-plugin-excalidraw = import ./obsidian/plugins/excalidraw { inherit pkgs; };

packages/go-mmproxy/default.nix

@@ -0,0 +1,15 @@
+{ pkgs, ... }:
+# AUTO-UPDATE: nix-update --flake --version=branch=master go-mmproxy
+pkgs.buildGoModule rec {
+  pname = "go-mmproxy";
+  version = "2.1-unstable-2023-11-20";
+
+  src = pkgs.fetchFromGitHub {
+    owner = "path-network";
+    repo = "go-mmproxy";
+    rev = "006247ca7ec618d2aff02052bac839ca769991a1";
+    hash = "sha256-sU0OYpJ0b/Fq5CzCA0TtC368LOyYCUkXt0pS4IEv8Ak=";
+  };
+
+  vendorHash = null;
+}