feat: add firezone gateway and allow trafic

hosts/ward/default.nix

@@ -7,6 +7,21 @@
   nodes,
   ...
 }:
+let
+  # FIXME: dont hardcode, filter global service domains by internal state
+  # FIXME: new entry here? make new adguardhome entry too.
+  # FIXME: new entry here? make new firezone entry too.
+  homeDomains = [
+    globals.services.grafana.domain
+    globals.services.immich.domain
+    globals.services.influxdb.domain
+    globals.services.loki.domain
+    globals.services.paperless.domain
+    globals.services.esphome.domain
+    globals.services.home-assistant.domain
+    "fritzbox.${globals.domains.personal}"
+  ];
+in
 {
   imports = [
     inputs.nixos-hardware.nixosModules.common-cpu-intel
@@ -63,6 +78,9 @@
     rekeyFile = config.node.secretsDir + "/firezone-gateway-token.age";
   };
 
+  networking.hosts.${globals.net.home-lan.vlans.services.hosts.ward-web-proxy.ipv6} = homeDomains;
+  networking.hosts.${globals.net.home-lan.vlans.services.hosts.ward-web-proxy.ipv4} = homeDomains;
+  systemd.services.firezone-gateway.environment.HEALTH_CHECK_ADDR = "127.0.0.1:17999";
   services.firezone.gateway = {
     enable = true;
     name = "ward";

hosts/ward/guests/adguardhome.nix

@@ -110,6 +110,7 @@ in
             [
               # FIXME: dont hardcode, filter global service domains by internal state
               # FIXME: new entry here? make new firezone entry too.
+              # FIXME: new entry here? make new firezone gateway on ward entry too.
               globals.services.grafana.domain
               globals.services.immich.domain
               globals.services.influxdb.domain

hosts/ward/net.nix

@@ -169,6 +169,7 @@
       {
         untrusted.interfaces = [ "wan" ];
         proxy-home.interfaces = [ "proxy-home" ];
+        firezone.interfaces = [ "tun-firezone" ];
         adguardhome.ipv4Addresses = [ globals.net.home-lan.vlans.services.hosts.ward-adguardhome.ipv4 ];
         adguardhome.ipv6Addresses = [ globals.net.home-lan.vlans.services.hosts.ward-adguardhome.ipv6 ];
         web-proxy.ipv4Addresses = [ globals.net.home-lan.vlans.services.hosts.ward-web-proxy.ipv4 ];
@@ -260,6 +261,28 @@
         to = [ "proxy-home" ];
         verdict = "accept";
       };
+
+      # masquerade firezone traffic
+      masquerade-firezone = {
+        from = [ "firezone" ];
+        to = [ "vlan-services" ];
+        masquerade = true;
+        late = true; # Only accept after any rejects have been processed
+        verdict = "accept";
+      };
+
+      # forward firezone traffic
+      forward-incoming-firezone-traffic = {
+        from = [ "firezone" ];
+        to = [ "vlan-services" ];
+        verdict = "accept";
+      };
+
+      forward-outgoing-firezone-traffic = {
+        from = [ "vlan-services" ];
+        to = [ "firezone" ];
+        verdict = "accept";
+      };
     };
   };