Update modules/proxy.nix

modules/proxy.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 
@@ -47,16 +48,23 @@ let
     abort @fuckai
   '';
 
-  mkIptablesRule =
+  mkSocatService =
-    port: proto: action:
+    port: proto:
-    let
+    lib.nameValuePair "socat-${proto}-${toString port}" {
-      op = if action == "add" then "-A" else "-D";
+      description = "Socat ${proto} proxy for port ${toString port}";
-      ignoreErr = if action == "remove" then "|| true" else "";
+      after = [
-    in
+        "network-online.target"
-    ''
+        "tailscaled.service"
-      iptables -t nat ${op} PREROUTING -p ${proto} --dport ${toString port} -j DNAT --to-destination ${upstream}:${toString port} ${ignoreErr}
+      ];
-      iptables -t nat ${op} POSTROUTING -p ${proto} -d ${upstream} --dport ${toString port} -j MASQUERADE ${ignoreErr}
+      wants = [ "network-online.target" ];
-    '';
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = "${pkgs.socat}/bin/socat ${lib.toUpper proto}-LISTEN:${toString port},fork,reuseaddr ${lib.toUpper proto}:${upstream}:${toString port}";
+        Restart = "on-failure";
+        RestartSec = "5s";
+        DynamicUser = true;
+      };
+    };
 
 in
 {
@@ -152,9 +160,10 @@ in
     '';
   };
 
-  boot.kernel.sysctl = {
+  systemd.services = lib.listToAttrs (
-    "net.ipv4.ip_forward" = 1;
+    (map (port: mkSocatService port "tcp") streamPorts)
-  };
+    ++ (map (port: mkSocatService port "udp") streamPorts)
+  );
 
   networking.firewall = {
     allowedTCPPorts = [
@@ -163,15 +172,5 @@ in
     ]
     ++ streamPorts;
     allowedUDPPorts = streamPorts;
-
-    extraCommands = lib.concatStringsSep "\n" (
-      (map (port: mkIptablesRule port "tcp" "add") streamPorts)
-      ++ (map (port: mkIptablesRule port "udp" "add") streamPorts)
-    );
-
-    extraStopCommands = lib.concatStringsSep "\n" (
-      (map (port: mkIptablesRule port "tcp" "remove") streamPorts)
-      ++ (map (port: mkIptablesRule port "udp" "remove") streamPorts)
-    );
   };
 }