# definition of the network layout which supports our tunnel
# architecture.

{
  # these are the available paths which a user is allowed to take
  # to reach a specified egress server.
  # when a user connects to a port defined here via wireguard,
  # the primary ingress server (us), will establish a connection with
  # the user and the backend egress server (this time, not via wireguard,
  # but with a specific dpi-evading protocol), and route the users packets
  # through to the egress.
  paths = [
    {
      port = 50501;
      egress = "taupe";
      destination = "finland";

      info = {
        uuid = "328c90a0-20ae-4d4c-9e54-97e9ab41c053";
        short = "b20629b505f39194";

        public = "_837k5niQBE-qmgqpZalH3cS_fAIBwv8dwMoDW1uvgk";
        keySecret = ../../secrets/tunnel/egress-key-taupe.age;
      };
    }
    {
      port = 50502;
      egress = "taureau";
      destination = "usa";

      info = {
        uuid = "826b8598-ed75-4782-9b7e-27e0e16e1141";
        short = "8f7e9f8a3fa46bf0";

        public = "HvR4iP8URERpPBM4oG1Bjfw3mIfN0MoL2x6MHlt_TUM";
        keySecret = ../../secrets/tunnel/egress-key-taureau.age;
      };
    }
  ];

  inherit (import ../../assets/vpn.nix) users;

  # we use a website as a "mask" for vless/reality, which will tell our peers
  # to pretend as if they're a user and a well-known website communicating with
  # each other, even though they know that the keys don't actually match up,
  # it's not possible to see that on the outside.
  mask = "microsoft.com";
}