Switch to wireguard

modules/torrents.nix

@@ -14,8 +14,8 @@ in
 
   config = lib.mkIf cfg.enable {
     sops.secrets = {
-      vpnCredentials = {
-        key = "openvpn/credentials";
+      vpnWireguardConfig = {
+        key = "wireguard/torrents.conf";
       };
       transmissionRpcCredentials = {
         key = "transmission/rpc_config.json";
@@ -32,8 +32,8 @@ in
       localAddress = "192.168.1.2";
 
       bindMounts = {
-        "${config.sops.secrets.vpnCredentials.path}" = {
-          hostPath = config.sops.secrets.vpnCredentials.path;
+        "${config.sops.secrets.vpnWireguardConfig.path}" = {
+          hostPath = config.sops.secrets.vpnWireguardConfig.path;
         };
         "${config.sops.secrets.transmissionRpcCredentials.path}" = {
           hostPath = config.sops.secrets.transmissionRpcCredentials.path;
@@ -74,91 +74,11 @@ in
         users.groups.www-data = {
           gid = 991;
         };
-        services.openvpn.servers.client = {
-          updateResolvConf = true;
-          config = ''
-            client
-            dev tun
-            resolv-retry infinite
-            nobind
-            persist-key
-            persist-tun
-            verb 3
-            remote-cert-tls server
-            ping 10
-            ping-restart 60
-            sndbuf 524288
-            rcvbuf 524288
-            cipher AES-256-CBC
-            tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA
-            proto udp
-            <ca>
-            -----BEGIN CERTIFICATE-----
-            MIIGIzCCBAugAwIBAgIJAK6BqXN9GHI0MA0GCSqGSIb3DQEBCwUAMIGfMQswCQYD
-            VQQGEwJTRTERMA8GA1UECAwIR290YWxhbmQxEzARBgNVBAcMCkdvdGhlbmJ1cmcx
-            FDASBgNVBAoMC0FtYWdpY29tIEFCMRAwDgYDVQQLDAdNdWxsdmFkMRswGQYDVQQD
-            DBJNdWxsdmFkIFJvb3QgQ0EgdjIxIzAhBgkqhkiG9w0BCQEWFHNlY3VyaXR5QG11
-            bGx2YWQubmV0MB4XDTE4MTEwMjExMTYxMVoXDTI4MTAzMDExMTYxMVowgZ8xCzAJ
-            BgNVBAYTAlNFMREwDwYDVQQIDAhHb3RhbGFuZDETMBEGA1UEBwwKR290aGVuYnVy
-            ZzEUMBIGA1UECgwLQW1hZ2ljb20gQUIxEDAOBgNVBAsMB011bGx2YWQxGzAZBgNV
-            BAMMEk11bGx2YWQgUm9vdCBDQSB2MjEjMCEGCSqGSIb3DQEJARYUc2VjdXJpdHlA
-            bXVsbHZhZC5uZXQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCifDn7
-            5E/Zdx1qsy31rMEzuvbTXqZVZp4bjWbmcyyXqvnayRUHHoovG+lzc+HDL3HJV+kj
-            xKpCMkEVWwjY159lJbQbm8kkYntBBREdzRRjjJpTb6haf/NXeOtQJ9aVlCc4dM66
-            bEmyAoXkzXVZTQJ8h2FE55KVxHi5Sdy4XC5zm0wPa4DPDokNp1qm3A9Xicq3Hsfl
-            LbMZRCAGuI+Jek6caHqiKjTHtujn6Gfxv2WsZ7SjerUAk+mvBo2sfKmB7octxG7y
-            AOFFg7YsWL0AxddBWqgq5R/1WDJ9d1Cwun9WGRRQ1TLvzF1yABUerjjKrk89RCzY
-            ISwsKcgJPscaDqZgO6RIruY/xjuTtrnZSv+FXs+Woxf87P+QgQd76LC0MstTnys+
-            AfTMuMPOLy9fMfEzs3LP0Nz6v5yjhX8ff7+3UUI3IcMxCvyxdTPClY5IvFdW7CCm
-            mLNzakmx5GCItBWg/EIg1K1SG0jU9F8vlNZUqLKz42hWy/xB5C4QYQQ9ILdu4ara
-            PnrXnmd1D1QKVwKQ1DpWhNbpBDfE776/4xXD/tGM5O0TImp1NXul8wYsDi8g+e0p
-            xNgY3Pahnj1yfG75Yw82spZanUH0QSNoMVMWnmV2hXGsWqypRq0pH8mPeLzeKa82
-            gzsAZsouRD1k8wFlYA4z9HQFxqfcntTqXuwQcQIDAQABo2AwXjAdBgNVHQ4EFgQU
-            faEyaBpGNzsqttiSMETq+X/GJ0YwHwYDVR0jBBgwFoAUfaEyaBpGNzsqttiSMETq
-            +X/GJ0YwCwYDVR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEL
-            BQADggIBADH5izxu4V8Javal8EA4DxZxIHUsWCg5cuopB28PsyJYpyKipsBoI8+R
-            XqbtrLLue4WQfNPZHLXlKi+A3GTrLdlnenYzXVipPd+n3vRZyofaB3Jtb03nirVW
-            Ga8FG21Xy/f4rPqwcW54lxrnnh0SA0hwuZ+b2yAWESBXPxrzVQdTWCqoFI6/aRnN
-            8RyZn0LqRYoW7WDtKpLmfyvshBmmu4PCYSh/SYiFHgR9fsWzVcxdySDsmX8wXowu
-            Ffp8V9sFhD4TsebAaplaICOuLUgj+Yin5QzgB0F9Ci3Zh6oWwl64SL/OxxQLpzMW
-            zr0lrWsQrS3PgC4+6JC4IpTXX5eUqfSvHPtbRKK0yLnd9hYgvZUBvvZvUFR/3/fW
-            +mpBHbZJBu9+/1uux46M4rJ2FeaJUf9PhYCPuUj63yu0Grn0DreVKK1SkD5V6qXN
-            0TmoxYyguhfsIPCpI1VsdaSWuNjJ+a/HIlKIU8vKp5iN/+6ZTPAg9Q7s3Ji+vfx/
-            AhFtQyTpIYNszVzNZyobvkiMUlK+eUKGlHVQp73y6MmGIlbBbyzpEoedNU4uFu57
-            mw4fYGHqYZmYqFaiNQv4tVrGkg6p+Ypyu1zOfIHF7eqlAOu/SyRTvZkt9VtSVEOV
-            H7nDIGdrCC9U/g1Lqk8Td00Oj8xesyKzsG214Xd8m7/7GmJ7nXe5
-            -----END CERTIFICATE-----
-            </ca>
-            tun-ipv6
-            script-security 2
-            fast-io
-            remote-random
-            remote de-fra-101.mullvad.net 1194
-            remote de-fra-201.mullvad.net 1194
-            remote de-fra-009.mullvad.net 1194
-            remote de-fra-002.mullvad.net 1194
-            remote de-fra-202.mullvad.net 1194
-            remote de-fra-005.mullvad.net 1194
-            remote de-fra-203.mullvad.net 1194
-            remote de-fra-003.mullvad.net 1194
-            remote de-fra-004.mullvad.net 1194
-            remote de-fra-008.mullvad.net 1194
-            remote de-fra-006.mullvad.net 1194
-            remote de-fra-007.mullvad.net 1194
-            remote de-fra-102.mullvad.net 1194
-            auth-user-pass ${config.sops.secrets.vpnCredentials.path}
-          '';
+        networking.wg-quick.interfaces.wg0 = {
+          configFile = config.sops.secrets.vpnWireguardConfig.path;
+          autostart = true;
         };
 
-        # dotnet 6 is EOL
-        # Will be fixed with https://github.com/NixOS/nixpkgs/issues/360592
-        nixpkgs.config.permittedInsecurePackages = [
-          "aspnetcore-runtime-6.0.36"
-          "aspnetcore-runtime-wrapped-6.0.36"
-          "dotnet-sdk-6.0.428"
-          "dotnet-sdk-wrapped-6.0.428"
-        ];
-
         services.transmission = {
           enable = true;
           package = pkgs-unstable.transmission_4;