feat: use networkd for routing config

Signed-off-by: Lander Van den Bulcke <landervandenbulcke@gmail.com>

hosts/hosting-02/default.nix

@@ -18,12 +18,48 @@
       80
       443
     ];
+    allowedUDPPorts = [
+      51820
+    ];
   };
 
-  systemd.network.networks."30-wan".address = [
+  networking.iproute2.enable = true;
+  systemd.network.config = {
+    routeTables = {
+      vpn = 133;
+    };
+    addRouteTablesToIPRoute2 = true;
+  };
+
+  systemd.network.networks."30-wan" = {
+    address = [
       "2a01:4f8:c013:7fc0::/64"
     ];
 
+    routingPolicyRules = [
+      {
+        From = "10.64.244.95/32";
+        Table = "vpn";
+      }
+      {
+        From = "fc00:bbbb:bbbb:bb01::1:f45e/128";
+        Table = "vpn";
+      }
+      {
+        User = config.users.users.vpn.uid;
+        Table = "vpn";
+        Family = "both";
+      }
+    ];
+  };
+
+  users.groups.vpn = { };
+  users.users.vpn = {
+    isSystemUser = true;
+    group = "vpn";
+    uid = 51280;
+  };
+
   networking.wireguard = {
     enable = true;
 
@@ -47,6 +83,7 @@
 
       listenPort = 51820;
       privateKeyFile = config.sops.secrets.wireguardKey.path;
+      table = "133";
     };
   };