aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.sops.yaml7
-rw-r--r--hosts/nyaan/network.nix67
-rw-r--r--hosts/sagittarius/network.nix45
-rw-r--r--secrets/wg-nyaan-private.txt26
-rw-r--r--secrets/wg-sagittarius-private.txt26
-rw-r--r--secrets/wireguard/nyaan.txt26
-rw-r--r--secrets/wireguard/sagittarius.txt26
-rw-r--r--wireguard.nix78
8 files changed, 148 insertions, 153 deletions
diff --git a/.sops.yaml b/.sops.yaml
index 239b481..49cb169 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -11,3 +11,10 @@ creation_rules:
- *machine_wonderland
- *machine_sagittarius
- *machine_underworld
+ - path_regex: secrets/wireguard/[^/]+\.(txt)$
+ key_groups:
+ - age:
+ - *admin_miran
+ - *machine_wonderland
+ - *machine_sagittarius
+ - *machine_underworld
diff --git a/hosts/nyaan/network.nix b/hosts/nyaan/network.nix
index e5d39aa..ea4f9a5 100644
--- a/hosts/nyaan/network.nix
+++ b/hosts/nyaan/network.nix
@@ -1,32 +1,22 @@
-{ config, ... }:
+{ config, flakeRoot, ... }:
let
secrets = config.sops.secrets;
- # NOTE: port is the same on every host
- wgPort = 51820;
in
{
+ imports = [ (flakeRoot + /wireguard.nix) ];
+
sops = {
age.keyFile = "/var/lib/sops-nix/key.txt";
- secrets = {
- "wg-priv-key" = {
- sopsFile = ../../secrets/wg-nyaan-private.txt;
- owner = "systemd-network";
- group = "systemd-network";
- mode = "0640";
- format = "binary";
- };
- "wireless.env" = {
- sopsFile = ../../secrets/wireless.env;
- owner = "wpa_supplicant";
- group = "wpa_supplicant";
- format = "dotenv";
- };
+ secrets."wireless.env" = {
+ sopsFile = ../../secrets/wireless.env;
+ owner = "wpa_supplicant";
+ group = "wpa_supplicant";
+ format = "dotenv";
};
};
networking = {
hostName = "nyaan";
- firewall.allowedUDPPorts = [ wgPort ];
useNetworkd = true;
wireless = {
enable = true;
@@ -71,45 +61,4 @@ in
2301:db8:acad:a::1 sagittarius sagittarius.local
'';
};
-
- systemd.network = {
- enable = true;
- networks."50-wg" = {
- matchConfig.Name = "wg0";
- address = [
- "2301:db8:acad:a::2/128"
- "192.168.23.2/32"
- ];
- };
- netdevs."50-wg" = {
- netdevConfig = {
- Kind = "wireguard";
- Name = "wg0";
- };
-
- wireguardConfig = {
- ListenPort = wgPort;
- PrivateKeyFile = config.sops.secrets."wg-priv-key".path;
- # To automatically create routes for everything in AllowedIPs,
- # add RouteTable=main
- RouteTable = "main";
- # FirewallMark marks all packets send and received by wg0 with the
- # number 42, which can be used to define policy rules on these packets.
- FirewallMark = 42;
- };
-
- wireguardPeers = [
- {
- # sagittarius
- PublicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI=";
- AllowedIPs = [
- "2301:db8:acad:a::1/128"
- "192.168.23.1/32"
- ];
- Endpoint = "95.216.136.85:${toString wgPort}";
- PersistentKeepalive = 1;
- }
- ];
- };
- };
}
diff --git a/hosts/sagittarius/network.nix b/hosts/sagittarius/network.nix
index 9612011..7dac324 100644
--- a/hosts/sagittarius/network.nix
+++ b/hosts/sagittarius/network.nix
@@ -1,15 +1,12 @@
-{ config, ... }:
-let
- # NOTE: port is the same on every host
- wgPort = 51820;
-in
+{ flakeRoot, ... }:
{
+ imports = [ (flakeRoot + /wireguard.nix) ];
+
networking = {
hostName = "sagittarius";
useNetworkd = true;
firewall = {
allowedTCPPorts = [ 22 ];
- allowedUDPPorts = [ wgPort ];
};
};
@@ -23,42 +20,6 @@ in
address = [ "2a01:4f9:c012:c7a7::1/64" ];
routes = [ { Gateway = "fe80::1"; } ];
};
- "50-wg" = {
- matchConfig.Name = "wg0";
- address = [
- "2301:db8:acad:a::1/128"
- "192.168.23.1/32"
- ];
- };
- };
-
- netdevs."50-wg" = {
- netdevConfig = {
- Kind = "wireguard";
- Name = "wg0";
- };
-
- wireguardConfig = {
- ListenPort = wgPort;
- PrivateKeyFile = config.sops.secrets."wg-priv-key".path;
- # To automatically create routes for everything in AllowedIPs,
- # add RouteTable=main
- RouteTable = "main";
- # FirewallMark marks all packets send and received by wg0 with the
- # number 42, which can be used to define policy rules on these packets.
- FirewallMark = 42;
- };
-
- wireguardPeers = [
- {
- # nyaan
- PublicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0=";
- AllowedIPs = [
- "2301:db8:acad:a::2/128"
- "192.168.23.2/32"
- ];
- }
- ];
};
};
}
diff --git a/secrets/wg-nyaan-private.txt b/secrets/wg-nyaan-private.txt
deleted file mode 100644
index b555f6c..0000000
--- a/secrets/wg-nyaan-private.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-{
- "data": "ENC[AES256_GCM,data:wvbx0vdyRV4pnyZUexK+ryiAQ4ftBu3GUfXaZY3oJVbUYPzP4eCghGaJoDcr,iv:3vbNks6l8AON8TKiVI8M4MY3X/+G7BhFhI4y1moJL08=,tag:wgVuh2/l9W6id32S0+N/fA==,type:str]",
- "sops": {
- "age": [
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRUkk5VzVjZS9NU2dlaFhB\nN1FyQjdrRnpsWjNZM2hkMzFuSFdKa01IbFRFCnArQ1FvaDMwSlFab1FnSmxTdllU\nTk1CbmQ4dFJvSmVhVGZBK2NpM21VbUEKLS0tIEhUc3RDUnkwS3NFdkRYVnZKTFA3\nUUtDcWVrd2ltd083UVZlQ3RUMkNrQlEKc3dzihHvFxvB8MKsCQMpOQl/EYyQgYeA\nWIP073tRAKRzd9YNtAMi/GgTyTi1kegsmXmkt0BILyBjo00kGNLaLA==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk"
- },
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYSTFianpCTENOWmZ4Vkl0\nMEF3WVpvN3MwSHREd2tnWTZYa3JRRldpYjFjCnNzQjdaWHVLMkpRTU9VakFua3JB\nc0NVYld5anhLWnFqOEpRRXg3c3VpdHcKLS0tIE1EZHZaN2dUZ2V6UmVGaWlja0d3\nMDBwU2JkOVpTbFNkZ01UQ2dHSzJmdGsKyPdHwEHY/c/uyg0/7OUPqdD3vEPDizOQ\nWVT5kzKETW29h9pQl7EDoLNP54gmBKtDEZ4JcY7nON4pAITS/DgeKg==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc"
- },
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzcUlONzZCVjl3b2R5azk4\nbjhpU0hlVEo3cEFHZXVNODlremNpdTRRZm1ZCjIyV1NsZk5Sam9DUWFwQ01iY08v\nUFdkMUdiS1VFZkcxZ1d3ODdFODJpaHcKLS0tIFNmQ2xxeUlTaUhnTENwT0dCR2x5\nN2wvS3ZZd3BqeUhqWHJRcFFiRWFrNXMKUrqv6PVR1fjfugcrj+elBa04lku/bMr5\nfDC7YRGcn8TsvqzCaE3fP0oPylIF4b9CkP9o/5aQuPbhoeCM0j+3wA==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern"
- },
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5ZnkyVjEyZ2xOblU4RFZO\nZXdrK0JBSy9aRThvTlkvVmlxeU1OUjBXRXkwCks2aCt3VkM4VG55K1dQclVHL3pn\nWTZEN2JWWkpBRkF0MzdYbU1VYnNOLzgKLS0tIFRwV2M1OXh1UnRTbTQvTHJESlE3\nbW5KRTJPenYyVUd2UVdLK3UzYS9rRVUKl36iZnE+33U8H7RaTIlJjuIQCXVRokZV\n4s9uHgh0mTXawJkAYD61Ans63v0L5jCZVbxKsgzxdDEXVdLb64XXLg==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6"
- }
- ],
- "lastmodified": "2026-05-23T16:54:07Z",
- "mac": "ENC[AES256_GCM,data:l5zPLY5e2hPl4AVQavBPYMX6UEQDcC5mNi3nmBR0LZd5YccGjRJwW5jyfT7ZPBQCfuEskzB3bfxpEWCETDcMQPtZpJpt4JXmgTOxSjxgcC3t8Sl0ZXWTPU+4Wi569agQOG3f3Y9sFKpqnADGG7EjMbCHX7WJQNu3c6h0VGNkhHI=,iv:oHB7P6+rsgQZLpblc/lqpqRpI03ebsWPWmmXDq2EvF4=,tag:/1K7/VA8fmbne+gwM0YT0g==,type:str]",
- "version": "3.13.1"
- }
-}
diff --git a/secrets/wg-sagittarius-private.txt b/secrets/wg-sagittarius-private.txt
deleted file mode 100644
index 97a64ab..0000000
--- a/secrets/wg-sagittarius-private.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-{
- "data": "ENC[AES256_GCM,data:jILnlk/Nqv5fW6cGMpM9B+ztCXfb9nUX7D/SDgsCsj70vjDEl+yFiSNApFbR,iv:kvxuOCHPLUj2r4lhoJlRoI0WeRUgmnC4SnGKdXvi5uk=,tag:sRdM9KwPEnIKP3qsPNVaMA==,type:str]",
- "sops": {
- "age": [
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLVk1MWWppMlFhRHVsS1Fk\nTjQvc2JJUEUvb29WMFFpSnlpd01qcDV6bFh3CnVFQ0N4THorRWxpdFVBUHFtOEM5\neEg5UEdYOEJjSC9jeitPV1h3QzkzR00KLS0tIHJNWXY0OCs4WDRUcU1RV2t1VXVP\nVnU4b29HQmJrVE9oWEY1bTZucGwxazAKN1+B96dHXjcDfVDtGiDpvh++pQ6qqwFP\nDavnBl3whhmPGyvKEN0AugJVDbIS/SJS6y0KIaOSK23qcKVJmunfeg==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk"
- },
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyM3BvMFJIUUVYVm4wNjBW\nWnFicXpGNDdXcllDVjl1SXhwTGcxQ2pNRTJVCjNnSzNxY0hSWElOSmFkS1B6Rk5i\nS2xYUEpZcmY1cEZSQ1RuWnAzVk0ySTQKLS0tIDNQZTluaUxCQStYd2tHdi9FQ0M5\nWTNKSFkyc0k4K0gzYytLYzBONnB6ZkkKfJWBolB91gvqPX5luDs85M9XRviKEq0v\nTyBLxqNHP4EQ0iinewhcHwoLiic1Rq4JyHZTdpnKIrCFNhFuIfmdkA==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc"
- },
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHRnB6NFY5eXVYQVgybGha\nd0s0Rm1xLytSalFBNnBmenhjRTFIMXo5QlNJCkM5RzBTeXE2ZUYzUGplNVFqckp5\ncWoyWTAzMDB4Yi9udWJBQ0U0MjUyT0UKLS0tIHNSR1g5VzZTdWdtM3k0ZkdVVEUx\ndk1FSFk3VitoVVZXaWlJbFdvSy9xcFEKhAf4pQzlZYjnHmdG67SfLB6gzJ3oSa82\nGs4j6FPV24TOWGimsd82hGXU9p+4IJG3dFtfEHWTxSdG5f4ZmcJINQ==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern"
- },
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1U2FCZ0tnR1hFTlVCT1ZS\nRHRCN2UwWjBnN3J2TnE2M2l3TjQvYVZlVVd3Ci9DZ0JiWUVGLzd5QWtOc3d5RFB4\nOUZrcm9vRFB2UFN3RGxGTXNEZ3dkWTgKLS0tIGUxNnJkNDdhaUdPbE5UbDlGS3JG\nS3NDT2ZkL2JEbGc5OGs4a3pibE5OSGMKHADuSCTrVMVQ79sB4BrAlpR0XNsjT0mt\nkazjomCzCnCxfM9Vk25OKlFr2SqjI9lE2hwkZVrC99ILShrvttahFQ==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6"
- }
- ],
- "lastmodified": "2026-05-23T16:37:46Z",
- "mac": "ENC[AES256_GCM,data:Sa+tyx46Y94k9JIUSY2xR/RSvmOu3xrAtOe3tx0cx84EjfFZe67smJlPiZtOTTbylZexlNZJ8NI9f2xzBT8TnYwecqlWD6hMhlfZKHuWRgtz/h53cziyVSLmFUGpv/3i6bB3gdWhOxWNolGOvCfavHzUJbNvuwOhk7LOnB/AZ8E=,iv:M7KxR9jQI8mAsllIbtq8HpvmHeqlgxXs3SWX4fqh4NU=,tag:GUBR/N1s03H38rwryGKe4w==,type:str]",
- "version": "3.13.1"
- }
-}
diff --git a/secrets/wireguard/nyaan.txt b/secrets/wireguard/nyaan.txt
new file mode 100644
index 0000000..76f636d
--- /dev/null
+++ b/secrets/wireguard/nyaan.txt
@@ -0,0 +1,26 @@
+{
+ "data": "ENC[AES256_GCM,data:Ng3FR3cU6mjQqyOkDhk8S1HUa4sO/+exJn/B+IKMnTNtG80ZWWzy8PgFJqAg,iv:mAOZLP9PWYUNXySiclpgyo2ZSkcF0MpiUXqwtNGkPAY=,tag:MvHabqCi+bsrlNuN3CfkHw==,type:str]",
+ "sops": {
+ "age": [
+ {
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxOXZKYjNXWjJ2eEFQNXAw\naytCZlQ0REJuODcxZitZM2hnTmVmbGZRVnlNCmNPa3ZBcmRFcHkvY1FqQllYb2Jl\nMXR3U3lCOFl2T1V4WmJnWXFwckczR2sKLS0tIFNWUHdydFNBOGFCUmpwUUt5dkNR\nZW1qbGJqbFN0cWM2SVAycTlWeGRDeE0KjGJMYucpTHDdl6DpF4ZomyOe0N4RIy50\naLHNY1zahrw0QngMRGrRqkQO5TYwB1w9LAjaAY8A9t1UPTFv3dpayw==\n-----END AGE ENCRYPTED FILE-----\n",
+ "recipient": "age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk"
+ },
+ {
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPcHNxREc0Q3hUVFY4c01n\nalBZbXhnNXlnVXV3TitQK1g3TFpMeE10cFIwCkZPNWVsOHViVUlmR2pyN3BtV3Zv\nQWcreVhuUzZtVXlkQTV3Y0pSWWVFM0kKLS0tIE1aWjd6Sm56Tzduckd6eXdMTjhw\naW9JSWQyRHhJQ09PY3V4c0xNSDZ5eFEKXmOmCQoav6GJ+t3qLlKRBxcARnkfzfY+\nUiKPZlELVtIR3Ph55XVwb+FXL73KSicJxV148LxGf9Bm67zK47tKyw==\n-----END AGE ENCRYPTED FILE-----\n",
+ "recipient": "age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc"
+ },
+ {
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNd0VYMUQvbmFYUXFsenZP\naXI1R1hNQzI2d21BWEdhQmZ5SkdFRTVENlVVCnlNWXNPV2RVa3RPQWloa0xwOWV0\nTjFvd2J1OUF5TDd6eGx0K29WVXZmYzQKLS0tIHE4VkdLK0pJU01UQjVhc2NpSjBU\nTGFwS25hK3RHdWpKRVlMcmVaWWdDaFEKEwqGjZvO2WWrbIjp91qIh8T5OlHbhB4Y\nq8R4dMYhAiBGU/N8dFrEIZLhHVRmLamg7eipOOh+MvFXLweFhMcBqA==\n-----END AGE ENCRYPTED FILE-----\n",
+ "recipient": "age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern"
+ },
+ {
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqUXNOUmZaY0RwTDlvRVdP\nWUJiL25jNThMMzlqYmlWMm1RM0JkNTFicFR3CnBGbEpQNTlwN2dEL1lLUEZ6T0lT\nNXRmTmlSTWIrMm9HekQ2Qm83SU1oZ0UKLS0tIEY4ODY0U2NvSUxUYWRZVXZqcjA0\nTlUrbHc1cVpsQkJzNDVZQ09BTWwzcTAK9+ybeJDwSIbHj5QmBazILaoBRRYkUE1i\n5PhvxBIvNcod05ZnTcvt3kMQMPTBe85cZQG1aaxnrIiKfVZeN8/o2Q==\n-----END AGE ENCRYPTED FILE-----\n",
+ "recipient": "age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6"
+ }
+ ],
+ "lastmodified": "2026-05-30T09:55:51Z",
+ "mac": "ENC[AES256_GCM,data:7eX5Kys9x65tk6+Kd0uTGgQXAoSuJnJ5V3D/eAN3gh9PrGjatc6Cqw45HPk6SqeYx7y6qCRK9ncdC3SYGX2vM2esREjQjgij9oNsKQvr7IKeb5QKB1rldwoPaWtsb6IfDnNew2nSPqaUw6R+K/hdMWKCfYFu5dGU0cbSoDH6DZ8=,iv:2YYQr7VtEnYn3UtgjovhKyCFAd3N/Xl+5+LwcPImJfo=,tag:nGTnUmabUaQUYYoeQLiNzQ==,type:str]",
+ "version": "3.13.1"
+ }
+}
diff --git a/secrets/wireguard/sagittarius.txt b/secrets/wireguard/sagittarius.txt
new file mode 100644
index 0000000..1cef967
--- /dev/null
+++ b/secrets/wireguard/sagittarius.txt
@@ -0,0 +1,26 @@
+{
+ "data": "ENC[AES256_GCM,data:OgzuAef2sEzf4cC7fHmmcUcdeiODfOwBS1IQ8/hN2MyrA+NqnVWYnpj9qR2J,iv:0JbA2r55QHJ7Qj8P6W3LKseimir/tciErWTeC82ln7Q=,tag:+mikffsQpyOqGC5PnFB0gw==,type:str]",
+ "sops": {
+ "age": [
+ {
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvM0NZVk9mdVo0Z3pJYyty\nMVV2eXNFVDM5SEVPS3BrSXl5S3IwRHE0a21vCnBHektiZDRvNDI3ZWovSjdFVDBG\nbnRLL2piekhiS1QrUitmY0tUMG1GSncKLS0tIEhvbTh6Nm1lamRrZ3MwNyt3THJJ\naVVFbnBNdkYzb3ZaazlUWnNWdlhjZ0UK+wp/uu7Q8XYoObBWKNqn4Nm8EOUBibpH\nkgvm8KE9mMFUMIbZILlO6yqPg/ppy2gBveboVgTvRCf9XlfHPj5RUg==\n-----END AGE ENCRYPTED FILE-----\n",
+ "recipient": "age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk"
+ },
+ {
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5bnJ1RjM2SVpHUGtkd0Rh\nblpEK3JUdEVWKy9ZZjBobnYyL0FzSU8xRWdZCisxK3ZwNDBJL00wVVp3L3IyNU5H\nZzhsNzhIdGpPWG9ZelZXZ3hjRDF2WDgKLS0tIDNsejNLaHZ1L0FmYUFDK2tNWVFP\nMGpJRTFLUkpjOTFMRVovVVRvTEF1ckEKE7DNcRUIXSmYJEJj/J7eIlnD+6+BhDpM\nNHrrPywKyHlqG6IS8oNI3OXM6tEZC1SDJ8zrE8x5uFJb42CBCodqJg==\n-----END AGE ENCRYPTED FILE-----\n",
+ "recipient": "age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc"
+ },
+ {
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRejJOSnRZZXFBUHFNMTQ0\nWGsxS2R6ZHUwVVRXVThKTmg3RVZyNmxHNUVrCkk4WU9Dc0hMV0xTb3dJd2R1enpH\nd1dyWmVxZmozMDBtWFdzSTF4cXpxNmcKLS0tIFBjeElqQzgzS01YanBabWxnUUti\nOUN3Yk45bGRlbHFoMmRHL0N3R01heW8KjcmdIpfVmRGaPVUuM75h2RvhmD88VnHy\n+ToQ58jIIq2ZhwCPGYtVvlBHiZjj57fp108BqfOZfBVuZlHBCmhUyQ==\n-----END AGE ENCRYPTED FILE-----\n",
+ "recipient": "age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern"
+ },
+ {
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqcHh4MzF5RU51dWhuY3pV\nOTdKMFV3TjhBQk5sL25WQ2dOZTlQSndZUW00CjI1RjM0TUQxNkdreGdiWk9Ca2E3\nQ2JaOXN3RFUreDJITkFoL1dxelpob1kKLS0tIHV2QjdqcjdLS0ZnR3hCcFM5THN3\nR0VjVkw0UXdTdCsrM3dzQTc5TGVOWDAKYtZOzX9chjMRRE46d3tsjv8AGF1f1WZd\nFPSc32u0ZFrcnuQDrM/KRi1mfV8chNMSPI+521KdnqcUrBWUYn54Tw==\n-----END AGE ENCRYPTED FILE-----\n",
+ "recipient": "age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6"
+ }
+ ],
+ "lastmodified": "2026-05-30T09:56:07Z",
+ "mac": "ENC[AES256_GCM,data:3qOpDxLQUPGKtU4TqI5RxOPiAIUCZBdoBD97Cyj0yazqECOZya/vvPGuYa+iq8MrNTtCdN9Aa9oLnIP2VXfQRR8na2X6Isx423J17Y75g5Qujnz7Szt4Gzsazvardy6Ibuy/MSOmfBbO7PFJTP6pkpVH4ICggByON1WasusTNhw=,iv:h2OSF/uDJY2rhVFtUvPyYcyh+EqkAP38VJlT0R2clY0=,tag:XpoFAeRNxPhwTAWe+E+XPA==,type:str]",
+ "version": "3.13.1"
+ }
+}
diff --git a/wireguard.nix b/wireguard.nix
new file mode 100644
index 0000000..04ec3bc
--- /dev/null
+++ b/wireguard.nix
@@ -0,0 +1,78 @@
+{ config, pkgs, ... }:
+let
+ hostname = config.networking.hostName;
+ conf = hosts."${hostname}";
+ privateKeyPath = ./secrets/wireguard/${hostname}.txt;
+
+ lib = pkgs.lib;
+ wgPort = 51820; # Common port used on all peers
+ firewallMark = 42;
+
+ hosts = {
+ sagittarius = {
+ address = "2301:db8:acad:a::1/128";
+ publicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI=";
+ endpoint = "95.216.136.85:${toString wgPort}";
+ };
+ nyaan = {
+ address = "2301:db8:acad:a::2/128";
+ publicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0=";
+ };
+ };
+
+ generatePeer =
+ hostname: values:
+ {
+ PublicKey = values.publicKey;
+ AllowedIPs = [ values.address ];
+ }
+ // lib.optionalAttrs (builtins.hasAttr "endpoint" values) {
+ Endpoint = values.endpoint;
+ PersistentKeepalive = 1;
+ };
+ generatePeers =
+ hostname:
+ let
+ peers = lib.attrsets.filterAttrs (k: v: k != hostname) hosts;
+ in
+ lib.attrsets.mapAttrsToList generatePeer peers;
+in
+{
+ sops.secrets."wireguard-${hostname}-pk" = {
+ sopsFile = privateKeyPath;
+ owner = "systemd-network";
+ group = "systemd-network";
+ mode = "0640";
+ format = "binary";
+ };
+
+ networking.firewall.allowedUDPPorts = [ wgPort ];
+
+ systemd.network = {
+ enable = true;
+ networks."50-wg" = {
+ matchConfig.Name = "wg0";
+ address = [ conf.address ];
+ };
+
+ netdevs."50-wg" = {
+ netdevConfig = {
+ Kind = "wireguard";
+ Name = "wg0";
+ };
+
+ wireguardConfig = {
+ ListenPort = wgPort;
+ PrivateKeyFile = config.sops.secrets."wireguard-${hostname}-pk".path;
+ # To automatically create routes for everything in AllowedIPs,
+ # add RouteTable=main
+ RouteTable = "main";
+ # FirewallMark marks all packets send and received by wg0 with the
+ # number, which can be used to define policy rules on these packets.
+ FirewallMark = firewallMark;
+ };
+
+ wireguardPeers = generatePeers hostname;
+ };
+ };
+}
generated by cgit v1.3.1 (git 2.54.0) at 2026-10-27 12:07:17 +0000