diff --git a/baldur/configuration.nix b/baldur/configuration.nix index 292e614..553f368 100644 --- a/baldur/configuration.nix +++ b/baldur/configuration.nix @@ -1,4 +1,4 @@ -{ pkgs, ... }: { +{ pkgs, config, ... }: { boot = { growPartition = true; kernelParams = [ "console=ttyS0" "panic=1" "boot.panic_on_fail" ]; @@ -130,6 +130,12 @@ enable = true; openFirewall = true; }; + # wgautomesh = { + # enable = true; + # settings = { + # interface = "wg0"; + # }; + # }; }; security.acme = { @@ -153,12 +159,41 @@ shell = pkgs.zsh; }; - networking.firewall = { - enable = true; - allowPing = true; - allowedTCPPorts = [ 8000 80 443 ]; - # allowedUDPPorts = [ ]; - # extraCommands = ''iptables -t raw -A OUTPUT -p udp -m udp --dport 137 -j CT --helper netbios-ns''; + networking = { + firewall = { + enable = true; + allowPing = true; + allowedTCPPorts = [ 51235 80 443 ]; + # allowedUDPPorts = [ ]; + # extraCommands = ''iptables -t raw -A OUTPUT -p udp -m udp --dport 137 -j CT --helper netbios-ns''; + }; + wg-quick.interfaces.wg0 = { + address = [ + "192.168.10.2/24" + ]; + peers = [ + { + # baldur + allowedIPs = [ + "192.168.10.1/24" + ]; + # endpoint = "demo.wireguard.io:12913"; + publicKey = "K57ikgFSR1O0CXWBxfQEu7uxSOsp3ePj/NMRets5pVc="; + # presharedKeyFile = config.age.secrets.baldur_wg_psk.path; + } + { + # odin + allowedIPs = [ + "192.168.10.1/24" + ]; + # endpoint = "demo.wireguard.io:12913"; + publicKey = "AY2kVl9Znp79wrgHjmTUX5aagJKay7barD4BcMir5SY="; + # presharedKeyFile = config.age.secrets.odin_wg_psk.path; + } + ]; + privateKeyFile = config.age.secrets."${config.networking.hostName}_wg_priv".path; + listenPort = 51235; + }; }; system.stateVersion = "22.11"; diff --git a/flake.nix b/flake.nix index 8df5c29..818e373 100644 --- a/flake.nix +++ b/flake.nix @@ -103,6 +103,10 @@ { # age.secrets.oauth_proxy_client_credentials.file = ./secrets/oauth_proxy_client_credentials.age; age.secrets.spotify_password = { file = ./secrets/spotify_password.age; owner = "bertof"; }; + age.secrets.baldur_wg_priv = { file = ./secrets/baldur_wg_priv.age; }; + age.secrets.odin_wg_priv = { file = ./secrets/odin_wg_priv.age; }; + age.secrets.baldur_wg_psk = { file = ./secrets/baldur_wg_psk.age; }; + age.secrets.odin_wg_psk = { file = ./secrets/odin_wg_psk.age; }; } ./nixos_modules/bertof_user.nix diff --git a/secrets/baldur_wg_priv.age b/secrets/baldur_wg_priv.age new file mode 100644 index 0000000..cc6012e --- /dev/null +++ b/secrets/baldur_wg_priv.age @@ -0,0 +1,25 @@ +age-encryption.org/v1 +-> ssh-ed25519 lC44xg eswmM0Q9AbLRCsQQq1ZlTnFzZAq4m3IjCBYy3GONuH4 +s/5WMKPYoW4oflZacxkkLkodch60wMbQdbKN9fIPkVw +-> ssh-ed25519 2L7QNA dkOQottCMaLj1iQSCmiyZpwJdJC/erUNAzf1aXB7RGA +GEUo6TNwN1jJXBmuEy8iTN3xVYYa1vZJF+tFdz5sEZs +-> ssh-ed25519 sNAOqA 0elrCKGKgQzyBd3mqVxTVq4bboiBJJKYi+UKNS5ZozA +K71ijRpi7hK2lqxjMF1LUKy0q83FbT1NovmDf+Kkk0Q +-> ssh-ed25519 13iwjQ tyC3lOXD830cFLGHc/Ae4ZgF2HhHb7iTlbmPQoJ+HBE +EIgi/nWMEFYIFhxFiZXYFm53Vm/1pBhhRYdru790oiw +-> ssh-ed25519 7MB20A +GrWTCkLWOa9uYnQZi4pgzLSJJiqKsZMX3Cq4ijlQBI +SxW5c3Txd/IaKelHc7VGgKnkqNVn8w1m+VyDqGTJYvk +-> ssh-ed25519 IvyYug CycRY3+o7lg6UWNjwd+VLApOWH2Mktl7Ud+pBBzq3yw +3mF23XkJ+cCB9kMEWkF+oYBNOKIQcDvHJIQ0jo7gWcA +-> ssh-ed25519 v7O/FA CFZvpkvFPOdw0ass4KPU+oLNUBAe3m2+9AAiHFA27Dc +IRONev1DEc+lD5kwveZdX/Ey8TlEQiATaiTDG5XjJUg +-> ssh-ed25519 Wzv8ew GhGJdN18tBkCk/Q0zqrfwp6MJVNVx20+z/l03m9BbGg +IkE2gHSfeSUqB4vu0kXZPw3+bMYYc2KszChenmR8z18 +-> ssh-ed25519 XgC3XA 1zEjnAUysdOuIm5dYKTwXD3sPDyLh8GWsonKxYw7hWo +/sxObfeZiZXTGQgx2tsga1ykuyweERwYkV7auvuR8bU +-> ssh-ed25519 l795CA B3WcfrFFNXFQjPKZ5K4M/prj7RCKKPkP8ktZ0XVghBM +hQhG8C3xd7QR4Eev7X8S94d5buxaJYXtNpzzLfO9jeg +-> vbUD;-grease Pu.[?[PM 2v0J'W_e EXW(UE +3VQcTpfcBjiL9iIK0MzJ5KAsg1p+ZX2hxfBwwrfY7Fsn72NeWH/MSxV3RRIUCOY +--- uooL6VvAvEpWbcnuq6gGDKpN0wOHympu0CVPZWyIddc +zc{g 3vRN("-jNc0z.c E4.آ~hwܪkБ7ٻX \ No newline at end of file diff --git a/secrets/baldur_wg_psk.age b/secrets/baldur_wg_psk.age new file mode 100644 index 0000000..947f912 --- /dev/null +++ b/secrets/baldur_wg_psk.age @@ -0,0 +1,25 @@ +age-encryption.org/v1 +-> ssh-ed25519 lC44xg K4dWWJ1lPXfhlAIRAybZOkBQp/LRJxRGmbOy5jlvi1I +BX9GP/JpsDjoG+cxNDqpRn5KI/YUJbsOLXHTBDwyUjA +-> ssh-ed25519 2L7QNA iXXL+Yb8hZvh3RYRDHtBUTtqHHY5oBKEtqmWhHlkt2o +0XgMpq6fHAYeusPS++Fc6HmFH28M3xNAY1N7ubaEHN0 +-> ssh-ed25519 sNAOqA 9NOzTgetjETYpwKD4HruFt2zyrJ7fAcNn70Oq38N+Ww +qJUthhdhGxBZ5jxjh6LbDR7aO5EY0opS1Z56jZpG3jU +-> ssh-ed25519 13iwjQ pPze3cWfSczM8n4WYY5CJcjIU/DGShpioJ9p885P7io +WuI/QZG7XTxP3BVo0wOACyKTtgRuLe9StVnherNethg +-> ssh-ed25519 7MB20A vtho1nIxUgJaIMo2LMCn4rmTSR4yWlT9AxNJ/cDWOmI +TtaLb344pbQq9k29qFMM3ee3okePsQav+EUt4Q31OTY +-> ssh-ed25519 IvyYug qKOrg57dpDecShTU2TMjMjrZCwXmpxGTiiexYujLPVE +hgTCdKOpyyHnPbV8eXXWskxd3nGFI/U2rHmhdudYuec +-> ssh-ed25519 v7O/FA gQJcXXvDefLoFAjj3Vep4qiggkDX8/nCCQh2w6sS8Xs +B0BQZdQIc+hWMfNVz54tAdFCTjcLSw1t+htSwC5MKUg +-> ssh-ed25519 Wzv8ew MdVlkPiVjagW9qgp6US0on0ctihFEtA0ISpHbf57i1k +83jmpZXFnyIY1tBKbgmfpA7inuPkhlTK3s43zASmwwI +-> ssh-ed25519 XgC3XA BthsRj8+CBrTySpWVTfxbzpE5RqjUKGlYEWehRCOKm0 +0XtGkYD6e2t/bzpXgMeKiw5NwRPUZMZ0Hpwf4c90Nsk +-> ssh-ed25519 l795CA SEp14FlOLzdCydp+1QEpbpbMuuzhM12ritcpZ4xDllg +FKKaCHlg74KBscVsH8E9H2KQyG2N9xxwp0oOG3oVTmU +-> y[|Z-grease )j`~y"}, +AjmSyODTMq+EbK0kDQs+Yw +--- FxyOaPmh4fQDzD/XGykiw6PwySqaiwyvuo1YSN/ULaU +q,X֖yd߭7q2硰=Jԟ9U~x*EjgȷB V8 \ No newline at end of file diff --git a/secrets/garage_rpc_secret.age b/secrets/garage_rpc_secret.age index be511ff..a5628d9 100644 Binary files a/secrets/garage_rpc_secret.age and b/secrets/garage_rpc_secret.age differ diff --git a/secrets/nextcloud_admin_secret.age b/secrets/nextcloud_admin_secret.age index c3fce91..16b39d3 100644 --- a/secrets/nextcloud_admin_secret.age +++ b/secrets/nextcloud_admin_secret.age @@ -1,26 +1,25 @@ age-encryption.org/v1 --> ssh-ed25519 lC44xg 9e5nfNFt2hdXNukpsEZMPamnZOgZWoU772CpLp5BY2M -BlrlZmQyllvyi0VH5FND1j1zQnYbzx62Z7Qbdh89sQM --> ssh-ed25519 2L7QNA 75i/WgIcLrP9oaMRE0CvToF/XrbmvrLmFEOOxLRuXkw -TeVzeoKkywajFAd1M73QTg3nggpatyOVu1dcLOBnH7U --> ssh-ed25519 sNAOqA DlEpU6pt3b3Brj7AF5yGs/+9FRJFhevDNgNMo+UXcgc -CRu+T7bCIxXFA4MSnn4/ztUaNbTJpDejXK+wveVWTRs --> ssh-ed25519 13iwjQ 43OjYsNkZ/5UQ5dfwxYB3bDFeuUHPW+XxAtyqmJMhH0 -V/P6Ystpx3PnGn+DOsTxe9ikCltNKwA9X8rymEzY3e4 --> ssh-ed25519 7MB20A gPC+CxOmDImMJap8SgkK9NpL4s/GSJmyX2umUmKjRA8 -3ic5wU2Oy3Gfj3GzinFDxFi1KPdWapstegb+zYowg6U --> ssh-ed25519 IvyYug P/7CQ6DQQym1kM/OLOG8Nakoebz7BNH5CK2DApx5UC8 -9zqvma+HyFRciXLE6DpsSEDOqHQwFTH+PMsm/O4Yjko --> ssh-ed25519 v7O/FA 1ge/Vw8r5EtumJI48XuXLEFG7aqorWH48Bqb8kSaBEo -KuQPV9X0zWAMtNj/APt+eTtfLiWDYV0DsLlRH7x9l0k --> ssh-ed25519 Wzv8ew El6uIpGgcyCuu9FKpjXOv5L9gItC3vi/yFFUNTFvcUM -7TDO3r9xfYKTtehaYg68hglQcSgmbzShY8mZRiqUtnk --> ssh-ed25519 XgC3XA 8zEhP9aNEmKUH2B8Dw4rzn+O6riE+c7jmFESYFRGV3M -Vmic1XoWQkxTXku+YJ905sdEdW6jRX5XwRGiel6W3ek --> ssh-ed25519 l795CA cMMrQ1PhDE6WMeP8+qfMsH+QUf5uPcgKh3xr2MRuASY -Rn6DNsW/8mrL9qYznNuan4iSxNMG4SAfJpZHrmefhHQ --> m-grease -0XiydRLe1NgiM8bul8te9GUStrFd6H4dOcB0SDRzf9X2XxhPCFcXUVxNGYoMHXrL -0zCXWMvDQoNAVhWXxPMgxEx6tyA3hVbjRQsAkjUve6ennirLbNBgc6E ---- DQM3pmcI7d8NtCe7Eox5gqsvlJPssjhugFUcShhB2Y0 -^f7%5E3Ir0P-a)r([ŕgOf8&œtŞT[_5@,"~ \ No newline at end of file +-> ssh-ed25519 lC44xg 91Drbhm8rawrH1Tf4i6sY3b4dV22PUCkXasYJDjnVBk +JP/im4nu9fRvC6lBmuZqtjK/MONa0QSBX9Je3tcMZnY +-> ssh-ed25519 2L7QNA p7gDPKqy1aSZo2l049BFUYzozamZe6xy0CZh8xeWBlo +xlC1v+bF9nJQkQ54ObXfi3Tvj3yVz4+JbHyxmIQGsDI +-> ssh-ed25519 sNAOqA OsIskIft3nuF89TJ66Gsyj64oV2G5+JJhd0tFuFLsGI +YkMztKrO0OtEtCdqnhNe3YkX493l+jSJT+k9sbScMKE +-> ssh-ed25519 13iwjQ 7PzPPgN6r8f/cUdSfTp5E9wWF1574yNwAtmuX5i3FxE +jfkjBP4GBmghOCaiQ6FGNaqoDvLlCt0Bbln4TxLNYiY +-> ssh-ed25519 7MB20A Fwbdkqeecc6cI9EN67VWSlT0kE4/IJIiANX9dtM5pA4 +8vMUxIxzQEwn+IB0QP4wxdixOd5fnsSHzVn86yearVM +-> ssh-ed25519 IvyYug OUah9hhgBilrcgdR/8u+POTWSwujWsp8AA+YiPmvFCs +arwEHcpNqCwswlob+KZlIdbmS5YHLfWUXKDfsWoU6dM +-> ssh-ed25519 v7O/FA yq5SYgje+HOJwZ9/bKITPv244Ao3aZCsLNkUw+L3dkA +2pU1nqZgUTLypnpbJ1prR59rMyfBAHhgK+8ddxQjKMs +-> ssh-ed25519 Wzv8ew y9fZuZAtknkDiZmXYn4ZWyDHoVZ3R9sm3vlzh4I7vhw +EJAnK5hjNK6Atz2VoQZeO/niZ6Coi3LywbGvxtqP3Bc +-> ssh-ed25519 XgC3XA z2WuzBfJPnwKJOY+fkgLsOEIArIPgUFtD8O2mLGg0m0 +cK8bD/QqVNJerThnAqtn91Q96TaLsKYSTG4yDNDFKaY +-> ssh-ed25519 l795CA tNto7MnYOtTlmjl/bhSZEcKDjqnn8ZlbW9BBQQDuAmA +43kE1/kjso/penSuM3MBSsURVG4rFJpsuCjxKJtWAHY +-> ,|t-grease +KOs7pQc4KksrMBNIFip3hz44UmaNEB6K+N4wX2/Oz7ayTQr6vg +--- 1BqdPneo6efppGPNy9GpeWxCqXfDPsKwj15gUVWDY0k +99mʇR#[oQЀԸ=l mvǕeF{P!aE(d ssh-ed25519 lC44xg mdip3HBP+qEHMNFgw+bCXJRr35yCxEqPg4V+pLdZMx0 +yMbZYirQlZMmr95StdYp/1wPjXaxjsNGX472ex3SMfc +-> ssh-ed25519 2L7QNA r+tO1POIf8Ayi8PC37rLf0p7Y1O5z5CasCHkRK7BtGs +Ts/86q2fOA9BQyuKTUZ8eac39MnPQ3MJM9y2XXVV7RA +-> ssh-ed25519 sNAOqA DLcdzGd38r3t4mLvbAFAD15evjuVVMlhgSD2md0HYRw +2B3LGMJWeVPhkPMmQx8A7aF5HUf6zRMMFG85GX/8e90 +-> ssh-ed25519 13iwjQ jtSOmjgGcGh2XqIoc58J5cgcH5M1O1Z9ZJS0M3TFrgI +M9EJKUUWwayAYhhGysvpJ2LVWyedn1k0Q9hT5kEt5MQ +-> ssh-ed25519 7MB20A kqYtQSu3sYRHi4bka/lXMimez0AFGFU5BqoFlGqKmjQ +Kmk3rIxRw8xeGtfC7cabLiP3DXGhd9oc7vwl/BUFvTQ +-> ssh-ed25519 IvyYug gMJj5DWImX/iNW+cY39tE4UJUbQlUqfEl0hMQjcS6lQ +u3mqyt2QmhkrYWAL02b5Pv81tXAgDif1QRZJLc61Nvk +-> ssh-ed25519 v7O/FA mzDFmhR9wPZT/Wj9Rra1d/8mIXMZfMqMKZ5Wroo9Ygc +Cz1il7hvvgJFqu4cqFSHbr3FpJAnMvE4RY2BTutXiqU +-> ssh-ed25519 Wzv8ew qv3oQQMhCw2UnZm6GRE24OJ47N9h2wtO4ayM80it/io +oIg6KVKFY1bh4HJkj6bUhXq+ThO1kl2w02GhMqHjFz0 +-> ssh-ed25519 XgC3XA P2CmO1HJLq3WzfKFv2gkgfyOQ89ks3Vjqv5lvUHRcDU +lNTqncVz7Eg2jVjzWGav50twa5XdN4oRhptjdGgUhrs +-> ssh-ed25519 l795CA Kw1lASAR6zB25xmAzatCH1TvkEWWQtSwS8c9lvvcFAc +HTBNX95GqBFtXV6mgGCtfh1lXlMDdwNaIp8i60cOfnQ +-> 0*Wg!:e-grease "7]bbwxk :0H<{U;0 vG +zh1b0AW0O2PICiREGYcbQ8/aktTtuGY6ppsGioeao53t +--- LoEv/DfNru/GjqqHLww788WIV5nvB7z5zAhByyRkKb8 +]vnDP+vBS5wy]Lf2u-sylsl:#] +dh)f޳[s-{pe! \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index bb39c46..99e272c 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -29,4 +29,8 @@ in "garage_rpc_secret.age".publicKeys = users ++ systems; "nextcloud_admin_secret.age".publicKeys = users ++ systems; "nextcloud_bucket_secret.age".publicKeys = users ++ systems; + "baldur_wg_priv.age".publicKeys = users ++ systems; + "baldur_wg_psk.age".publicKeys = users ++ systems; + "odin_wg_priv.age".publicKeys = users ++ systems; + "odin_wg_psk.age".publicKeys = users ++ systems; } diff --git a/secrets/spotify_password.age b/secrets/spotify_password.age index 0cb9796..c273dba 100644 --- a/secrets/spotify_password.age +++ b/secrets/spotify_password.age @@ -1,25 +1,25 @@ age-encryption.org/v1 --> ssh-ed25519 lC44xg qx8ScB8EQSt3zYm/ssCJBJhDnKRnISz6SDIVtp/CVUw -KyzGrKbTVrd7+3Qxo7pIE+B0ZfGY8M/ELyX5S52pEfo --> ssh-ed25519 2L7QNA O+yiQWRmwQTbxVrcR2ZVblt+x67AHVd7Y44uNUG9zWQ -PJJGYlh9IbQBvVKPSUD3PkneDFpNnnSoGBys6NPGygk --> ssh-ed25519 sNAOqA iKRbXMoXHsvHu0tvlQSSTILcs130LnK7OtkehxoY2DU -9OuE3tdLJhLgcx0UF+PacOd/0XlDj1cZiHcw6YTO0Oo --> ssh-ed25519 13iwjQ PxNLHEV39X1RKvuIBiklbiv5ygjZWRAD/qGOxyaJw3g -Srqdehuwr6tJ7dCWnV5QsR1mcqb/LUxlnZkKr1gmEPo --> ssh-ed25519 7MB20A 6nwXbt9UPU08srOlnbVqsM9yYrl2SVmtOhpDoZRpyCw -1IGrugG0f/anCT6nYffvt1kYcoeWNxeROCz0M0Rmmtk --> ssh-ed25519 IvyYug 1GtgYlEX8tZzK1mBmudqjNr1TE7ZvBuYkY7CyvCsIlk -KEwiOT+zne9PfK+Rh5KxgnBaly8IU/GWG5vubJbOSho --> ssh-ed25519 v7O/FA dmGBSmygIDpqoF+n4/AWxkvAnvB9lcf3eXjqpHA001M -LTBJvyp/MGYFcLeLBjdatTW0P1Hf1d65AUxBtaANvFg --> ssh-ed25519 Wzv8ew GRwNr4PcQeiI0qgcl3QGeo2HcFt65DPw+EXHxeNZZD8 -i5QkEwUZLDqJ5VsMcYajnmZ50d04J1WJ406U+bFlQIA --> ssh-ed25519 XgC3XA DexhXmClBwlAd4/gXAM58MMmLhpqSDCjvWYX2E7X9EU -HNvLtXFRpXh5JJwUfZ00lXyx+I+RWZpQSli4SbZdvYc --> ssh-ed25519 l795CA pVq9WszC4VOy61ewkCSykfCnknmsOftp+Cg5Hr5epT4 -1bV64LwANMZe77fPql+GlM0h/8LJ8bW4dETkkoX/MeE --> ]|v,%-grease -cdOa3vKMVCeih1cEkDclR4tHhbAZ+3DMprjA9w ---- Fh6zKYunbTLngs9QpT12TtRPvgjO1zypM4Q9YbgzqJw -L#b*XHU17۝2ѽF4ćHK \ No newline at end of file +-> ssh-ed25519 lC44xg fNZm17lZ7I9OF+9KzG5CkE20zykUWfNiVqfinwfaT1E +YIf4M7hFVDHxkdbgj9YIkjan31NV298Ne94/5mm+lVw +-> ssh-ed25519 2L7QNA CVA8eZ1QVvcI7SF5Qf7UlG71NbNHZF0XzEPe7YsZFgw +9YX+T2GKTXbJNzSPLoXE27q4oV6LQ5HubgoCwKGxS4Y +-> ssh-ed25519 sNAOqA lJ4QkGtqdcUn9ofknOG/HaCHm6Ya0ZD/UsV5o4GDVkE +RmKwFfLGnJmNcnC7fAF5BEHMYEjmW2PyUUpJIqtcRKQ +-> ssh-ed25519 13iwjQ 1uvoQrLZ+DmBhHvei8rHTWsUkDnJVHq7IJQXeZ6Y/Dk +dwMrSGWryp5pw4bjHAJciVwq+HtrAbu3n/BqZdlfq2k +-> ssh-ed25519 7MB20A Xmx38wKS0U/yHhCh30ovmik/9g0ryVLgg89DFx4bH1g +xzrwGBJrmK8e5jNGkDEQ3AxkJ7t7l6qMatSFHwP3i9c +-> ssh-ed25519 IvyYug /Z3qxc0ETc8hjTYuRT8n0jm3ASLsHqWcDWmqHDiqY3w +8oNzoP8oe6EbxXoKRScpd9ioRMtux+a9wQXLuFO570I +-> ssh-ed25519 v7O/FA R4o3qe/Hdr8NU5/Lh5XWI5PcwlAqQhEDxnLax8woc2A +yewsVadr1x6aOjodDC5AJiAaJ1UZErlwhJrgvKLy4UU +-> ssh-ed25519 Wzv8ew G0eVpxoMIMQsGZw+bMYMHHs/zlLiYtfdLrMHZztIGWc +Pe8BgxqumkizijWUzX4pnnow5oZCQi7byRCd+qNIobI +-> ssh-ed25519 XgC3XA MJWNf+zH+qO1F5uRI6nsEXbeE+8Yq+gSF2RFq0kF0Tg +Wfqs7UtrwBtCH8clxv44mAXaYCLVJTHSpsP1OD9Py2c +-> ssh-ed25519 l795CA VRGxjEzDM3Wh6PVbl609EAopcPPc5k/74j7J14el1lY +YtjcGN40o4R3e5JGlD9Vtks5Aaa1SvjEW6yjQJeiX1A +-> &-grease ~#1cr +D7H4Rvbgs/yp9b8X +--- uHnGjluN/BbsC3f0jQuq5SaOU2woJF+aQLBL6cKPlGk +Ģ I Y-_`Ċ܉8uO{h0 \ No newline at end of file