--wip-- [skip ci]

This commit is contained in:
Filippo Berto 2023-06-27 11:14:35 +02:00
parent 1b3937f23d
commit 006406e9a6
No known key found for this signature in database
GPG key ID: FE98AE5EC52B1056
11 changed files with 174 additions and 56 deletions

View file

@ -1,4 +1,4 @@
{ pkgs, ... }: {
{ pkgs, config, ... }: {
boot = {
growPartition = true;
kernelParams = [ "console=ttyS0" "panic=1" "boot.panic_on_fail" ];
@ -130,6 +130,12 @@
enable = true;
openFirewall = true;
};
# wgautomesh = {
# enable = true;
# settings = {
# interface = "wg0";
# };
# };
};
security.acme = {
@ -153,13 +159,42 @@
shell = pkgs.zsh;
};
networking.firewall = {
networking = {
firewall = {
enable = true;
allowPing = true;
allowedTCPPorts = [ 8000 80 443 ];
allowedTCPPorts = [ 51235 80 443 ];
# allowedUDPPorts = [ ];
# extraCommands = ''iptables -t raw -A OUTPUT -p udp -m udp --dport 137 -j CT --helper netbios-ns'';
};
wg-quick.interfaces.wg0 = {
address = [
"192.168.10.2/24"
];
peers = [
{
# baldur
allowedIPs = [
"192.168.10.1/24"
];
# endpoint = "demo.wireguard.io:12913";
publicKey = "K57ikgFSR1O0CXWBxfQEu7uxSOsp3ePj/NMRets5pVc=";
# presharedKeyFile = config.age.secrets.baldur_wg_psk.path;
}
{
# odin
allowedIPs = [
"192.168.10.1/24"
];
# endpoint = "demo.wireguard.io:12913";
publicKey = "AY2kVl9Znp79wrgHjmTUX5aagJKay7barD4BcMir5SY=";
# presharedKeyFile = config.age.secrets.odin_wg_psk.path;
}
];
privateKeyFile = config.age.secrets."${config.networking.hostName}_wg_priv".path;
listenPort = 51235;
};
};
system.stateVersion = "22.11";
}

View file

@ -103,6 +103,10 @@
{
# age.secrets.oauth_proxy_client_credentials.file = ./secrets/oauth_proxy_client_credentials.age;
age.secrets.spotify_password = { file = ./secrets/spotify_password.age; owner = "bertof"; };
age.secrets.baldur_wg_priv = { file = ./secrets/baldur_wg_priv.age; };
age.secrets.odin_wg_priv = { file = ./secrets/odin_wg_priv.age; };
age.secrets.baldur_wg_psk = { file = ./secrets/baldur_wg_psk.age; };
age.secrets.odin_wg_psk = { file = ./secrets/odin_wg_psk.age; };
}
./nixos_modules/bertof_user.nix

View file

@ -0,0 +1,25 @@
age-encryption.org/v1
-> ssh-ed25519 lC44xg eswmM0Q9AbLRCsQQq1ZlTnFzZAq4m3IjCBYy3GONuH4
s/5WMKPYoW4oflZacxkkLkodch60wMbQdbKN9fIPkVw
-> ssh-ed25519 2L7QNA dkOQottCMaLj1iQSCmiyZpwJdJC/erUNAzf1aXB7RGA
GEUo6TNwN1jJXBmuEy8iTN3xVYYa1vZJF+tFdz5sEZs
-> ssh-ed25519 sNAOqA 0elrCKGKgQzyBd3mqVxTVq4bboiBJJKYi+UKNS5ZozA
K71ijRpi7hK2lqxjMF1LUKy0q83FbT1NovmDf+Kkk0Q
-> ssh-ed25519 13iwjQ tyC3lOXD830cFLGHc/Ae4ZgF2HhHb7iTlbmPQoJ+HBE
EIgi/nWMEFYIFhxFiZXYFm53Vm/1pBhhRYdru790oiw
-> ssh-ed25519 7MB20A +GrWTCkLWOa9uYnQZi4pgzLSJJiqKsZMX3Cq4ijlQBI
SxW5c3Txd/IaKelHc7VGgKnkqNVn8w1m+VyDqGTJYvk
-> ssh-ed25519 IvyYug CycRY3+o7lg6UWNjwd+VLApOWH2Mktl7Ud+pBBzq3yw
3mF23XkJ+cCB9kMEWkF+oYBNOKIQcDvHJIQ0jo7gWcA
-> ssh-ed25519 v7O/FA CFZvpkvFPOdw0ass4KPU+oLNUBAe3m2+9AAiHFA27Dc
IRONev1DEc+lD5kwveZdX/Ey8TlEQiATaiTDG5XjJUg
-> ssh-ed25519 Wzv8ew GhGJdN18tBkCk/Q0zqrfwp6MJVNVx20+z/l03m9BbGg
IkE2gHSfeSUqB4vu0kXZPw3+bMYYc2KszChenmR8z18
-> ssh-ed25519 XgC3XA 1zEjnAUysdOuIm5dYKTwXD3sPDyLh8GWsonKxYw7hWo
/sxObfeZiZXTGQgx2tsga1ykuyweERwYkV7auvuR8bU
-> ssh-ed25519 l795CA B3WcfrFFNXFQjPKZ5K4M/prj7RCKKPkP8ktZ0XVghBM
hQhG8C3xd7QR4Eev7X8S94d5buxaJYXtNpzzLfO9jeg
-> vbUD;-grease Pu.[?[PM 2v0J'W_e EXW(UE
3VQcTpfcBjiL9iIK0MzJ5KAsg1p+ZX2hxfBwwrfY7Fsn72NeWH/MSxV3RRIUCOY
--- uooL6VvAvEpWbcnuq6gGDKpN0wOHympu0CVPZWyIddc
zc»¸<>³<C2B3>…Üg —3v¦RžNÊ(î<>"ßÒ-jNÏc0z.¾c E4¨ƒšü.Ø¢Ï~hñw<>ܪ³¢äðò­k¹ôÐ7Ù»Xü

25
secrets/baldur_wg_psk.age Normal file
View file

@ -0,0 +1,25 @@
age-encryption.org/v1
-> ssh-ed25519 lC44xg K4dWWJ1lPXfhlAIRAybZOkBQp/LRJxRGmbOy5jlvi1I
BX9GP/JpsDjoG+cxNDqpRn5KI/YUJbsOLXHTBDwyUjA
-> ssh-ed25519 2L7QNA iXXL+Yb8hZvh3RYRDHtBUTtqHHY5oBKEtqmWhHlkt2o
0XgMpq6fHAYeusPS++Fc6HmFH28M3xNAY1N7ubaEHN0
-> ssh-ed25519 sNAOqA 9NOzTgetjETYpwKD4HruFt2zyrJ7fAcNn70Oq38N+Ww
qJUthhdhGxBZ5jxjh6LbDR7aO5EY0opS1Z56jZpG3jU
-> ssh-ed25519 13iwjQ pPze3cWfSczM8n4WYY5CJcjIU/DGShpioJ9p885P7io
WuI/QZG7XTxP3BVo0wOACyKTtgRuLe9StVnherNethg
-> ssh-ed25519 7MB20A vtho1nIxUgJaIMo2LMCn4rmTSR4yWlT9AxNJ/cDWOmI
TtaLb344pbQq9k29qFMM3ee3okePsQav+EUt4Q31OTY
-> ssh-ed25519 IvyYug qKOrg57dpDecShTU2TMjMjrZCwXmpxGTiiexYujLPVE
hgTCdKOpyyHnPbV8eXXWskxd3nGFI/U2rHmhdudYuec
-> ssh-ed25519 v7O/FA gQJcXXvDefLoFAjj3Vep4qiggkDX8/nCCQh2w6sS8Xs
B0BQZdQIc+hWMfNVz54tAdFCTjcLSw1t+htSwC5MKUg
-> ssh-ed25519 Wzv8ew MdVlkPiVjagW9qgp6US0on0ctihFEtA0ISpHbf57i1k
83jmpZXFnyIY1tBKbgmfpA7inuPkhlTK3s43zASmwwI
-> ssh-ed25519 XgC3XA BthsRj8+CBrTySpWVTfxbzpE5RqjUKGlYEWehRCOKm0
0XtGkYD6e2t/bzpXgMeKiw5NwRPUZMZ0Hpwf4c90Nsk
-> ssh-ed25519 l795CA SEp14FlOLzdCydp+1QEpbpbMuuzhM12ritcpZ4xDllg
FKKaCHlg74KBscVsH8E9H2KQyG2N9xxwp0oOG3oVTmU
-> y[|Z-grease )j`~y"},
AjmSyODTMq+EbK0kDQs+Yw
--- FxyOaPmh4fQDzD/XGykiw6PwySqaiwyvuo1YSN/ULaU
qÕ,‡XêÖydß­7ˆq¶‡2Ÿ¡¸Ÿç¡°²¼Ó=ïú®JáüÔŸ9U~x*À—EúþÔÚ­jgÈ·ÜÀ öV8û

Binary file not shown.

View file

@ -1,26 +1,25 @@
age-encryption.org/v1
-> ssh-ed25519 lC44xg 9e5nfNFt2hdXNukpsEZMPamnZOgZWoU772CpLp5BY2M
BlrlZmQyllvyi0VH5FND1j1zQnYbzx62Z7Qbdh89sQM
-> ssh-ed25519 2L7QNA 75i/WgIcLrP9oaMRE0CvToF/XrbmvrLmFEOOxLRuXkw
TeVzeoKkywajFAd1M73QTg3nggpatyOVu1dcLOBnH7U
-> ssh-ed25519 sNAOqA DlEpU6pt3b3Brj7AF5yGs/+9FRJFhevDNgNMo+UXcgc
CRu+T7bCIxXFA4MSnn4/ztUaNbTJpDejXK+wveVWTRs
-> ssh-ed25519 13iwjQ 43OjYsNkZ/5UQ5dfwxYB3bDFeuUHPW+XxAtyqmJMhH0
V/P6Ystpx3PnGn+DOsTxe9ikCltNKwA9X8rymEzY3e4
-> ssh-ed25519 7MB20A gPC+CxOmDImMJap8SgkK9NpL4s/GSJmyX2umUmKjRA8
3ic5wU2Oy3Gfj3GzinFDxFi1KPdWapstegb+zYowg6U
-> ssh-ed25519 IvyYug P/7CQ6DQQym1kM/OLOG8Nakoebz7BNH5CK2DApx5UC8
9zqvma+HyFRciXLE6DpsSEDOqHQwFTH+PMsm/O4Yjko
-> ssh-ed25519 v7O/FA 1ge/Vw8r5EtumJI48XuXLEFG7aqorWH48Bqb8kSaBEo
KuQPV9X0zWAMtNj/APt+eTtfLiWDYV0DsLlRH7x9l0k
-> ssh-ed25519 Wzv8ew El6uIpGgcyCuu9FKpjXOv5L9gItC3vi/yFFUNTFvcUM
7TDO3r9xfYKTtehaYg68hglQcSgmbzShY8mZRiqUtnk
-> ssh-ed25519 XgC3XA 8zEhP9aNEmKUH2B8Dw4rzn+O6riE+c7jmFESYFRGV3M
Vmic1XoWQkxTXku+YJ905sdEdW6jRX5XwRGiel6W3ek
-> ssh-ed25519 l795CA cMMrQ1PhDE6WMeP8+qfMsH+QUf5uPcgKh3xr2MRuASY
Rn6DNsW/8mrL9qYznNuan4iSxNMG4SAfJpZHrmefhHQ
-> m-grease
0XiydRLe1NgiM8bul8te9GUStrFd6H4dOcB0SDRzf9X2XxhPCFcXUVxNGYoMHXrL
0zCXWMvDQoNAVhWXxPMgxEx6tyA3hVbjRQsAkjUve6ennirLbNBgc6E
--- DQM3pmcI7d8NtCe7Eox5gqsvlJPssjhugFUcShhB2Y0
^äf¶¦ªŸÃ£7%Í5ëEë3Ir0¬ÖP-a)rúÓ([Å•ãgO€fú‰8&›Å“tžÅžT[ŸëÕ_”±§å5°@ª,"„ƒ~
-> ssh-ed25519 lC44xg 91Drbhm8rawrH1Tf4i6sY3b4dV22PUCkXasYJDjnVBk
JP/im4nu9fRvC6lBmuZqtjK/MONa0QSBX9Je3tcMZnY
-> ssh-ed25519 2L7QNA p7gDPKqy1aSZo2l049BFUYzozamZe6xy0CZh8xeWBlo
xlC1v+bF9nJQkQ54ObXfi3Tvj3yVz4+JbHyxmIQGsDI
-> ssh-ed25519 sNAOqA OsIskIft3nuF89TJ66Gsyj64oV2G5+JJhd0tFuFLsGI
YkMztKrO0OtEtCdqnhNe3YkX493l+jSJT+k9sbScMKE
-> ssh-ed25519 13iwjQ 7PzPPgN6r8f/cUdSfTp5E9wWF1574yNwAtmuX5i3FxE
jfkjBP4GBmghOCaiQ6FGNaqoDvLlCt0Bbln4TxLNYiY
-> ssh-ed25519 7MB20A Fwbdkqeecc6cI9EN67VWSlT0kE4/IJIiANX9dtM5pA4
8vMUxIxzQEwn+IB0QP4wxdixOd5fnsSHzVn86yearVM
-> ssh-ed25519 IvyYug OUah9hhgBilrcgdR/8u+POTWSwujWsp8AA+YiPmvFCs
arwEHcpNqCwswlob+KZlIdbmS5YHLfWUXKDfsWoU6dM
-> ssh-ed25519 v7O/FA yq5SYgje+HOJwZ9/bKITPv244Ao3aZCsLNkUw+L3dkA
2pU1nqZgUTLypnpbJ1prR59rMyfBAHhgK+8ddxQjKMs
-> ssh-ed25519 Wzv8ew y9fZuZAtknkDiZmXYn4ZWyDHoVZ3R9sm3vlzh4I7vhw
EJAnK5hjNK6Atz2VoQZeO/niZ6Coi3LywbGvxtqP3Bc
-> ssh-ed25519 XgC3XA z2WuzBfJPnwKJOY+fkgLsOEIArIPgUFtD8O2mLGg0m0
cK8bD/QqVNJerThnAqtn91Q96TaLsKYSTG4yDNDFKaY
-> ssh-ed25519 l795CA tNto7MnYOtTlmjl/bhSZEcKDjqnn8ZlbW9BBQQDuAmA
43kE1/kjso/penSuM3MBSsURVG4rFJpsuCjxKJtWAHY
-> ,|t-grease
KOs7pQc4KksrMBNIFip3hz44UmaNEB6K+N4wX2/Oz7ayTQr6vg
--- 1BqdPneo6efppGPNy9GpeWxCqXfDPsKwj15gUVWDY0k
9¶»9ÊümʇRþ#ÐðÎè¤[o„»Q<C2BB>ŽŒ¤Ð€ˆÔ¸=ól <0A>mõÑvÇ•eF{P!¡ª”aEÄ(§d<mcç}W·j£Í3Tç¥í±tãÔ"ì

Binary file not shown.

BIN
secrets/odin_wg_priv.age Normal file

Binary file not shown.

26
secrets/odin_wg_psk.age Normal file
View file

@ -0,0 +1,26 @@
age-encryption.org/v1
-> ssh-ed25519 lC44xg mdip3HBP+qEHMNFgw+bCXJRr35yCxEqPg4V+pLdZMx0
yMbZYirQlZMmr95StdYp/1wPjXaxjsNGX472ex3SMfc
-> ssh-ed25519 2L7QNA r+tO1POIf8Ayi8PC37rLf0p7Y1O5z5CasCHkRK7BtGs
Ts/86q2fOA9BQyuKTUZ8eac39MnPQ3MJM9y2XXVV7RA
-> ssh-ed25519 sNAOqA DLcdzGd38r3t4mLvbAFAD15evjuVVMlhgSD2md0HYRw
2B3LGMJWeVPhkPMmQx8A7aF5HUf6zRMMFG85GX/8e90
-> ssh-ed25519 13iwjQ jtSOmjgGcGh2XqIoc58J5cgcH5M1O1Z9ZJS0M3TFrgI
M9EJKUUWwayAYhhGysvpJ2LVWyedn1k0Q9hT5kEt5MQ
-> ssh-ed25519 7MB20A kqYtQSu3sYRHi4bka/lXMimez0AFGFU5BqoFlGqKmjQ
Kmk3rIxRw8xeGtfC7cabLiP3DXGhd9oc7vwl/BUFvTQ
-> ssh-ed25519 IvyYug gMJj5DWImX/iNW+cY39tE4UJUbQlUqfEl0hMQjcS6lQ
u3mqyt2QmhkrYWAL02b5Pv81tXAgDif1QRZJLc61Nvk
-> ssh-ed25519 v7O/FA mzDFmhR9wPZT/Wj9Rra1d/8mIXMZfMqMKZ5Wroo9Ygc
Cz1il7hvvgJFqu4cqFSHbr3FpJAnMvE4RY2BTutXiqU
-> ssh-ed25519 Wzv8ew qv3oQQMhCw2UnZm6GRE24OJ47N9h2wtO4ayM80it/io
oIg6KVKFY1bh4HJkj6bUhXq+ThO1kl2w02GhMqHjFz0
-> ssh-ed25519 XgC3XA P2CmO1HJLq3WzfKFv2gkgfyOQ89ks3Vjqv5lvUHRcDU
lNTqncVz7Eg2jVjzWGav50twa5XdN4oRhptjdGgUhrs
-> ssh-ed25519 l795CA Kw1lASAR6zB25xmAzatCH1TvkEWWQtSwS8c9lvvcFAc
HTBNX95GqBFtXV6mgGCtfh1lXlMDdwNaIp8i60cOfnQ
-> 0*Wg!:e-grease "7]bbwxk :0H<{U;0 vG
zh1b0AW0O2PICiREGYcbQ8/aktTtuGY6ppsGioeao53t
--- LoEv/DfNru/GjqqHLww788WIV5nvB7z5zAhByyRkKb8
]°¤vnDP¤®ÒòÁýÒ+ØúvBS5¿w¨yžä]»øLfÈ2u-syl“±sæl:#]
dh)«fÞ³[œsµ-ù…{ØpÓe×

View file

@ -29,4 +29,8 @@ in
"garage_rpc_secret.age".publicKeys = users ++ systems;
"nextcloud_admin_secret.age".publicKeys = users ++ systems;
"nextcloud_bucket_secret.age".publicKeys = users ++ systems;
"baldur_wg_priv.age".publicKeys = users ++ systems;
"baldur_wg_psk.age".publicKeys = users ++ systems;
"odin_wg_priv.age".publicKeys = users ++ systems;
"odin_wg_psk.age".publicKeys = users ++ systems;
}

View file

@ -1,25 +1,25 @@
age-encryption.org/v1
-> ssh-ed25519 lC44xg qx8ScB8EQSt3zYm/ssCJBJhDnKRnISz6SDIVtp/CVUw
KyzGrKbTVrd7+3Qxo7pIE+B0ZfGY8M/ELyX5S52pEfo
-> ssh-ed25519 2L7QNA O+yiQWRmwQTbxVrcR2ZVblt+x67AHVd7Y44uNUG9zWQ
PJJGYlh9IbQBvVKPSUD3PkneDFpNnnSoGBys6NPGygk
-> ssh-ed25519 sNAOqA iKRbXMoXHsvHu0tvlQSSTILcs130LnK7OtkehxoY2DU
9OuE3tdLJhLgcx0UF+PacOd/0XlDj1cZiHcw6YTO0Oo
-> ssh-ed25519 13iwjQ PxNLHEV39X1RKvuIBiklbiv5ygjZWRAD/qGOxyaJw3g
Srqdehuwr6tJ7dCWnV5QsR1mcqb/LUxlnZkKr1gmEPo
-> ssh-ed25519 7MB20A 6nwXbt9UPU08srOlnbVqsM9yYrl2SVmtOhpDoZRpyCw
1IGrugG0f/anCT6nYffvt1kYcoeWNxeROCz0M0Rmmtk
-> ssh-ed25519 IvyYug 1GtgYlEX8tZzK1mBmudqjNr1TE7ZvBuYkY7CyvCsIlk
KEwiOT+zne9PfK+Rh5KxgnBaly8IU/GWG5vubJbOSho
-> ssh-ed25519 v7O/FA dmGBSmygIDpqoF+n4/AWxkvAnvB9lcf3eXjqpHA001M
LTBJvyp/MGYFcLeLBjdatTW0P1Hf1d65AUxBtaANvFg
-> ssh-ed25519 Wzv8ew GRwNr4PcQeiI0qgcl3QGeo2HcFt65DPw+EXHxeNZZD8
i5QkEwUZLDqJ5VsMcYajnmZ50d04J1WJ406U+bFlQIA
-> ssh-ed25519 XgC3XA DexhXmClBwlAd4/gXAM58MMmLhpqSDCjvWYX2E7X9EU
HNvLtXFRpXh5JJwUfZ00lXyx+I+RWZpQSli4SbZdvYc
-> ssh-ed25519 l795CA pVq9WszC4VOy61ewkCSykfCnknmsOftp+Cg5Hr5epT4
1bV64LwANMZe77fPql+GlM0h/8LJ8bW4dETkkoX/MeE
-> ]|v,%-grease
cdOa3vKMVCeih1cEkDclR4tHhbAZ+3DMprjA9w
--- Fh6zKYunbTLngs9QpT12TtRPvgjO1zypM4Q9YbgzqJw
¯ÈL#¢b*Šå«XÎHU1þ7Û<37>é2×ÔÜѽF4<46>­†Ä‡HÙï”K׈†<>í
-> ssh-ed25519 lC44xg fNZm17lZ7I9OF+9KzG5CkE20zykUWfNiVqfinwfaT1E
YIf4M7hFVDHxkdbgj9YIkjan31NV298Ne94/5mm+lVw
-> ssh-ed25519 2L7QNA CVA8eZ1QVvcI7SF5Qf7UlG71NbNHZF0XzEPe7YsZFgw
9YX+T2GKTXbJNzSPLoXE27q4oV6LQ5HubgoCwKGxS4Y
-> ssh-ed25519 sNAOqA lJ4QkGtqdcUn9ofknOG/HaCHm6Ya0ZD/UsV5o4GDVkE
RmKwFfLGnJmNcnC7fAF5BEHMYEjmW2PyUUpJIqtcRKQ
-> ssh-ed25519 13iwjQ 1uvoQrLZ+DmBhHvei8rHTWsUkDnJVHq7IJQXeZ6Y/Dk
dwMrSGWryp5pw4bjHAJciVwq+HtrAbu3n/BqZdlfq2k
-> ssh-ed25519 7MB20A Xmx38wKS0U/yHhCh30ovmik/9g0ryVLgg89DFx4bH1g
xzrwGBJrmK8e5jNGkDEQ3AxkJ7t7l6qMatSFHwP3i9c
-> ssh-ed25519 IvyYug /Z3qxc0ETc8hjTYuRT8n0jm3ASLsHqWcDWmqHDiqY3w
8oNzoP8oe6EbxXoKRScpd9ioRMtux+a9wQXLuFO570I
-> ssh-ed25519 v7O/FA R4o3qe/Hdr8NU5/Lh5XWI5PcwlAqQhEDxnLax8woc2A
yewsVadr1x6aOjodDC5AJiAaJ1UZErlwhJrgvKLy4UU
-> ssh-ed25519 Wzv8ew G0eVpxoMIMQsGZw+bMYMHHs/zlLiYtfdLrMHZztIGWc
Pe8BgxqumkizijWUzX4pnnow5oZCQi7byRCd+qNIobI
-> ssh-ed25519 XgC3XA MJWNf+zH+qO1F5uRI6nsEXbeE+8Yq+gSF2RFq0kF0Tg
Wfqs7UtrwBtCH8clxv44mAXaYCLVJTHSpsP1OD9Py2c
-> ssh-ed25519 l795CA VRGxjEzDM3Wh6PVbl609EAopcPPc5k/74j7J14el1lY
YtjcGN40o4R3e5JGlD9Vtks5Aaa1SvjEW6yjQJeiX1A
-> &-grease ~#1cr
D7H4Rvbgs/yp9b8X
--- uHnGjluN/BbsC3f0jQuq5SaOU2woJF+aQLBL6cKPlGk
äØüÄ¢ú I å†öY-‰_`ÂĊ܉ä8žíuŽOÝÁ{œhƒøûë0ãº