1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

{
  lib,
  pkgs,
  config,
  ...
}:
let
  enable = true;

  metaMark = "0x6d6f6c65";
  ctMark = "0x00000f41";

  bypassRuleset = pkgs.writeText "mullvad-tailscale-bypass.nft" ''
    table inet mullvad_tailscale_bypass {
      chain output {
        type route hook output priority 0; policy accept;
        ip daddr 100.64.0.0/10 meta mark set ${metaMark} ct mark set ${ctMark}
        ip6 daddr fd7a:115c:a1e0::/48 meta mark set ${metaMark} ct mark set ${ctMark}
        oifname "tailscale0" meta mark set ${metaMark} ct mark set ${ctMark}
      }
      chain input {
        type filter hook input priority -100; policy accept;
        ip saddr 100.64.0.0/10 meta mark set ${metaMark} ct mark set ${ctMark}
        ip6 saddr fd7a:115c:a1e0::/48 meta mark set ${metaMark} ct mark set ${ctMark}
        iifname "tailscale0" meta mark set ${metaMark} ct mark set ${ctMark}
      }
    }
  '';
in
lib.mkIf enable {
  age.secrets.mullvad.file = ../../secrets/mullvad.age;

  services.mullvad-vpn = {
    enable = true;
    package = pkgs.mullvad-vpn;
  };

  systemd.services.mullvad-tailscale-bypass = {
    description = "Exempt tailnet traffic from the Mullvad tunnel and kill switch";
    wantedBy = [ "multi-user.target" ];
    after = [ "network-pre.target" ];
    before = [ "mullvad-daemon.service" ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      ExecStart = pkgs.writeShellScript "mullvad-tailscale-bypass-start" ''
        ${pkgs.nftables}/bin/nft delete table inet mullvad_tailscale_bypass 2>/dev/null || true
        ${pkgs.nftables}/bin/nft -f ${bypassRuleset}
      '';
    };
  };

  systemd.services.mullvad-provision = {
    description = "Log in to Mullvad and lock networking to the tunnel";
    wantedBy = [ "multi-user.target" ];
    after = [ "mullvad-daemon.service" ];
    requires = [ "mullvad-daemon.service" ];
    path = [ config.services.mullvad-vpn.package ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
    };
    script = ''
      until mullvad status >/dev/null 2>&1; do sleep 1; done
      mullvad account login "$(cat ${config.age.secrets.mullvad.path})"
      mullvad lan set block
      mullvad lockdown-mode set on
      mullvad auto-connect set on
      mullvad connect
    '';
  };
}