1 files changed, 63 insertions, 35 deletions
diff --git a/os/srv/i2p.nix b/os/srv/i2p.nix
index fa7f102..5e36c20 100644
--- a/os/srv/i2p.nix
+++ b/os/srv/i2p.nix
@@ -1,7 +1,8 @@
 {
   config,
   lib,
-  pkgs,
+  masterDomain,
+  securityTemplates,
   ...
 }:
 let
@@ -9,45 +10,72 @@ let
 in
 {
   options.os.srv.i2p = {
-    enable = lib.mkEnableOption "enables i2pd";
-    enableBrowser = lib.mkEnableOption "enables mullvad browser for browsing eepsites";
+    enable = lib.mkEnableOption "enables a flexible, polymorphic i2pd deployment profile";
+
+    mode = lib.mkOption {
+      type = lib.types.enum [
+        "server"
+        "client"
+      ];
+      default = "client";
+      description = "";
+    };
   };
 
-  config = lib.mkMerge [
-    (lib.mkIf cfg.enable {
-      services.i2pd = {
-        enable = true;
-        enableIPv6 = true;
-        # upnp.enable = true;
-        bandwidth = 1024;
-        reseed.verify = true;
-        ntcp2 = {
-          enable = true;
-          # published = true;
-        };
-        ssu2 = {
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        services.i2pd = {
           enable = true;
-          # published = true;
+          enableIPv6 = true;
+          reseed.verify = true;
+
+          yggdrasil.enable = true;
+
+          proto = {
+            http.enable = true;
+            httpProxy.enable = true;
+            socksProxy = {
+              enable = true;
+              outproxyEnable = true;
+            };
+            sam.enable = true;
+            i2pControl.enable = true;
+          };
         };
-        yggdrasil = {
-          enable = true;
-          address = "200:5857:a255:4db6:8687:6928:ddc4:dad6";
+      }
+
+      (lib.mkIf (cfg.mode == "server") {
+        services.i2pd = {
+          bandwidth = 4096;
+
+          ntcp2.published = true;
+          ssu2.published = true;
+
+          #TODO add address
+          yggdrasil.address = "";
         };
-        proto = {
-          http.enable = true;
-          httpProxy.enable = true;
-          socksProxy = {
-            enable = true;
-            outproxyEnable = true;
+
+        os.cluster.nginxProxies."i2p.${masterDomain}" = {
+          enableACME = true;
+          forceSSL = true;
+          locations."/" = {
+            proxyPass = "http://${config.os.core.network.ips.relay-vm}:7070";
+            extraConfig = securityTemplates.restrictToInternal;
           };
-          sam.enable = true;
-          i2pControl.enable = true;
         };
-      };
-      # environment.systemPackages = [ pkgs.i2pd-tools ];
-    })
-    (lib.mkIf cfg.enableBrowser {
-      environment.systemPackages = [ pkgs.mullvad-browser ];
-    })
-  ];
+      })
+
+      (lib.mkIf (cfg.mode == "client") {
+        services.i2pd = {
+          bandwidth = 512;
+
+          ntcp2.published = false;
+          ssu2.published = false;
+
+          yggdrasil.address = "";
+        };
+      })
+    ]
+  );
 }