From cc99c25966727177fb299562e0a3217001981601 Mon Sep 17 00:00:00 2001
From: Asyncnomi <federez@asyncnomi.fr>
Date: Tue, 22 Jul 2025 18:24:28 +0200
Subject: [PATCH] imprv mesh

---
 shared/bastion.nix                      |  1 +
 shared/{commons => bastion}/forward.nix |  0
 shared/commons/mesh.nix                 | 20 ++++++++------------
 3 files changed, 9 insertions(+), 12 deletions(-)
 rename shared/{commons => bastion}/forward.nix (100%)

diff --git a/shared/bastion.nix b/shared/bastion.nix
index 0c2ec72..6cc8899 100644
--- a/shared/bastion.nix
+++ b/shared/bastion.nix
@@ -3,5 +3,6 @@
     # Import dependencies
     imports = [
         ./bastion/wireguard.nix
+        ./bastion/forward.nix
     ];
 }
\ No newline at end of file
diff --git a/shared/commons/forward.nix b/shared/bastion/forward.nix
similarity index 100%
rename from shared/commons/forward.nix
rename to shared/bastion/forward.nix
diff --git a/shared/commons/mesh.nix b/shared/commons/mesh.nix
index 4b3f6f8..e1c7fc1 100644
--- a/shared/commons/mesh.nix
+++ b/shared/commons/mesh.nix
@@ -37,9 +37,9 @@ let
             "mesh-${shorten peerName}-${toString remoteZone}-${toString remoteId}" = {
                 ips = [
                     "172.19.${toString myId}.${toString myId}/32"
-                    "172.19.${toString remoteId}.${toString myId}/32"
+                    "172.19.${toString myId}.${toString remoteId}/32"
                     "fc00::${toString myId}:${toString myId}/128"
-                    "fc00::${toString remoteId}:${toString myId}/128"
+                    "fc00::${toString myId}:${toString remoteId}/128"
                 ];
                 privateKeyFile = config.age.secrets."wg-private-zone-${toString myZone}-id-${toString myId}".path;
                 listenPort = 51000 + remoteId;
@@ -48,8 +48,8 @@ let
                     publicKey = peerConfig.wg-pub;
                     allowedIPs = [
                         # Allow mesh trafic
-                        "172.19.0.0/17"
-                        "fc00::/96"
+                        "172.19.${toString peerConfig.id}.0/24"
+                        "fc00::${toString peerConfig.id}:0/96"
                         # Allow mgmt transport
                         "172.19.128.0/17"
                         "fc00:f::/96"
@@ -68,17 +68,13 @@ let
 
     generateRoute = peerName: peerConfig: ''
         # Static route to declare static wireguard peer inner tunnel ip (that has been thrown away to the "off" table)
-        ${pkgs.iproute2}/bin/ip route replace 172.19.${toString myId}.${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} scope link
-        ${pkgs.iproute2}/bin/ip -6 route replace fc00::${toString myId}:${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} scope link
-
-        # Redirect
-        ${pkgs.iproute2}/bin/ip route replace 172.19.${toString peerConfig.id}.0/24 via 172.19.${toString myId}.${toString peerConfig.id}
-        ${pkgs.iproute2}/bin/ip -6 route replace fc00::${toString peerConfig.id}:0/112 via fc00::${toString myId}:${toString peerConfig.id}
+        ${pkgs.iproute2}/bin/ip route replace 172.19.${toString peerConfig.id}.0/24 dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} scope link
+        ${pkgs.iproute2}/bin/ip -6 route replace fc00::${toString peerConfig.id}:0/112 dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} scope link
 
         # Return path for mgmt trafic
         ${if lib.elem peerName mapping.bastion then ''
-            ${pkgs.iproute2}/bin/ip route replace 172.19.${toString (peerConfig.zone + 127)}.0/24 via 172.19.${toString myPeer.id}.${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id}
-            ${pkgs.iproute2}/bin/ip -6 route replace fc00:f::${toString (peerConfig.zone + 127)}:0/112 via fc00::${toString myPeer.id}:${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id}
+            ${pkgs.iproute2}/bin/ip route replace 172.19.${toString (peerConfig.zone + 127)}.0/24 via 172.19.${toString peerConfig.id}.${toString myId} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id}
+            ${pkgs.iproute2}/bin/ip -6 route replace fc00:f::${toString (peerConfig.zone + 127)}:0/112 via fc00::${toString peerConfig.id}:${toString myId} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id}
         '' else ""}
     '';