hexa- changed the topic of #nixos-on-your-router to: NixOS on your Router
THFKA4 has quit [Changing host]
THFKA4 has joined #nixos-on-your-router
sphalerite_ has joined #nixos-on-your-router
sphalerite has quit [Quit: WeeChat 2.4]
sphalerite_ is now known as sphalerite
pie_ has quit [Ping timeout: 252 seconds]
<gchristensen> the nixos org's macs run NixOS, and macOS in a VM.
<gchristensen> recently we added wireguard to the mix, so Hydra SSH's to the mac's guest via wg
<gchristensen> specifically, the host runs wg, and we forward 2200 to the guest's :22: https://github.com/NixOS/nixos-org-configurations/blob/master/macs/host/networking.nix#L27-L48
<gchristensen> to do that, we changed externalInterface to wg0, but this (I guess predictably) broke the VM's ability to talk to the internet. is there a way to have my cake and eat it too?
<gchristensen> (I guess I could run wg inside the guest directly, but that would be not a small project, and I'd rather move to wg sooner than later)
<eyJhb> Wait, what part of this is the VM?
<gchristensen> heh
<gchristensen> back in 5min and I'll lay it out a bit more clearly
<eyJhb> Couldn't you just add a secoundary card to the VM?
<eyJhb> Ohh btw.. the topic needs to be changed to include samueldr logging link, so people know the channel is logged :)
<gchristensen> change it :)
<eyJhb> gchristensen: I can't do that, can I?
<gchristensen> try
eyJhb changed the topic of #nixos-on-your-router to: NixOS on your Router || https://logs.nix.samueldr.com/nixos-on-your-router
<eyJhb> Sweet, but isn't that a admin only operation?
<gchristensen> only if the channel mode is +t
<gchristensen> for small & niche channels I like to leave it -t
<gchristensen> okay so
<gchristensen> we have Apple Mac Minis running NixOS, and NixOS is running wireguard and qemu
<gchristensen> inside qemu, we run macOS
<gchristensen> I'd like to forward port 2200 from the wg0 interface to the macOS guest's port 22
<gchristensen> okay I drew out how I want it to work
<gchristensen> hopefully that is useful
pie_ has joined #nixos-on-your-router
<cransom> you could swap the externalInterface back to the right one and set up a socat/haproxy/whatever to tcp forward 2200->22. or add more proxy to the mix and run a socks setup and configure the vm to use said proxy if you'd like to see all sorts of logging for the connections its making that are less visible on a nat setup.
<gchristensen> hm
<gchristensen> so actually I really like that the vm's ssh isn't public
<gchristensen> the socks proxy is definitely interesting
<gchristensen> do we have a service already setup for running a socks proxy?
<cransom> unless you count tor, or an autossh with -D, we don't seem to have a plain old socks proxy.
<gchristensen> I'm sure an auditor would be thrilled to hear our mac based infra fetches deps over tor
<cransom> though it probably doesn't need to be socks specifically, http should also work.
<gchristensen> (not that we have an auditor, but it might be good)
mmlb3 has joined #nixos-on-your-router
<gchristensen> socat TCP-LISTEN:2200,fork,so-bindtodevice=wg0 TCP:
<gchristensen> so easy!
<cransom> hrm. i wonder if you could do that in systemd with just an nc.
<gchristensen> nc is tough to mkae bidirectional I think?
<cransom> if you are trying from the cli with pipes, yes. but if systemd was being an inetd kind of thing
<gchristensen> oh!
<gchristensen> hrm!
Guanin has joined #nixos-on-your-router
v0|d has quit [Ping timeout: 248 seconds]
<eyJhb> gchristensen: works?
<gchristensen> socat works a treat :)
<eyJhb> socat is a nice tool, use it all the time too!
<eyJhb> But.. For.. Completely other reasons
<gchristensen> :P
<eyJhb> I should properly still move my router at some point...
<eyJhb> But the time, where do I get it...
v0|d has joined #nixos-on-your-router
v0|d has quit [Ping timeout: 258 seconds]