googlebot
f2f5761c83
All checks were successful
Check Flake / check-flake (push) Successful in 3m15s
Replace the single VPN container (veth pair, host-side auth scripts) with a multi-container setup on a shared bridge network: - Dedicated VPN container handles all PIA auth, WireGuard config, NAT, and optional port forwarding DNAT - Service containers default-route through VPN container (leak-proof by topology) - Host runs tinyproxy on bridge for PIA API bootstrap before WG is up - WG interface is still created in host netns and moved into VPN container namespace - Monthly renewal to ensure that connection stays up (PIA allows connections to last up to 2 months) - Drop OpenVPN support entirely
22 lines
365 B
Nix
22 lines
365 B
Nix
{ config, lib, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.networking;
|
|
in
|
|
{
|
|
imports = [
|
|
./pia-vpn
|
|
./tailscale.nix
|
|
./sandbox.nix
|
|
];
|
|
|
|
options.networking.ip_forward = mkEnableOption "Enable ip forwarding";
|
|
|
|
config = mkIf cfg.ip_forward {
|
|
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
|
|
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
|
|
};
|
|
}
|