# reference: https://www.procustodibus.com/blog/2022/06/multi-hop-wireguard/#site-gateway-as-a-spoke
# this configuration is for a device on the home network
# it exposes the entire home network to outside peers

{config, pkgs, ...}@inputs: {
    networking = {
        firewall.allowedUDPPorts = [56878];
        wireguard = {
            enable = true;
            interfaces.wg0 = {
                ips = [ "192.168.87.250/32"];
                listenPort = 56878;
                privateKeyFile = "/root/wg.keys";

                peers = [
                    {
                        name = "hub";
                        publicKey = "XEaJXQW+7llbreoK161NkMhFxlctL1UK8nFiY/GtuC0=";
                        allowedIPs = [ "192.168.87.0/25"];
                        endpoint = "173.249.36.74:56878";
                        persistentKeepalive = 20;
                    }
                ];

                postSetup = ''
                    ${pkgs.iptables}/bin/iptables -t mangle -A PREROUTING -i wg0 -j MARK --set-mark 0x30
                    ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING ! -o wg0 -m mark --mark 0x30 -j MASQUERADE
                '';
                postShutdown = ''
                    ${pkgs.iptables}/bin/iptables -t mangle -D PREROUTING -i wg0 -j MARK --set-mark 0x30
                    ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING ! -o wg0 -m mark --mark 0x30 -j MASQUERADE
                '';
            };
        };
    };
}