aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--etc/dns/sorre.internal.zone23
-rw-r--r--hosts/tower/network.nix1
-rw-r--r--hosts/tower/web/vaultwarden.nix12
-rw-r--r--hosts/underworld/network.nix3
-rw-r--r--secrets/wireguard/nyaan.txt26
-rw-r--r--secrets/wireguard/sagittarius.txt26
-rw-r--r--secrets/wireguard/underworld.txt18
-rw-r--r--share/system/client-common.nix2
-rw-r--r--wireguard.nix112
9 files changed, 10 insertions, 213 deletions
diff --git a/etc/dns/sorre.internal.zone b/etc/dns/sorre.internal.zone
deleted file mode 100644
index c84dcdc..0000000
--- a/etc/dns/sorre.internal.zone
+++ /dev/null
@@ -1,23 +0,0 @@
-$ORIGIN sorre.internal.
-$TTL 3600
-
-;; Nameservers/DNS setup
-@ IN SOA ns1.sorre.internal. hostmaster.sorre.internal. (
- 2026070700 ; serial (YYYYMMDDnn format)
- 3600 ; refresh
- 600 ; retry
- 604800 ; expire
- 3600 ; negative cache TTL
- )
-@ IN NS ns1
-ns1 IN AAAA 2301:db8:acad:a::1
-
-;; Hosts
-sagittarius IN AAAA 2301:db8:acad:a::1
-nyaan IN AAAA 2301:db8:acad:a::2
-pixel8 IN AAAA 2301:db8:acad:a::3
-
-;; Services
-vaultwarden IN CNAME sagittarius
-music IN CNAME sagittarius
-git IN CNAME sagittarius
diff --git a/hosts/tower/network.nix b/hosts/tower/network.nix
index 8bd6091..eb6d6d0 100644
--- a/hosts/tower/network.nix
+++ b/hosts/tower/network.nix
@@ -21,7 +21,6 @@
};
};
-
services.tailscale = {
enable = true;
openFirewall = true;
diff --git a/hosts/tower/web/vaultwarden.nix b/hosts/tower/web/vaultwarden.nix
index bf3c924..c277d65 100644
--- a/hosts/tower/web/vaultwarden.nix
+++ b/hosts/tower/web/vaultwarden.nix
@@ -1,4 +1,9 @@
-{ lib, config, pkgs, ... }:
+{
+ lib,
+ config,
+ pkgs,
+ ...
+}:
let
cfg = config.services.vaultwarden;
domain = "vaultwarden.sorre.internal";
@@ -30,7 +35,10 @@ in
serviceConfig.Type = "oneshot";
description = "Back up vaultwarden data";
conflicts = [ "vaultwarden.service" ];
- path = [ pkgs.gnutar pkgs.systemdMinimal ];
+ path = [
+ pkgs.gnutar
+ pkgs.systemdMinimal
+ ];
enableStrictShellChecks = true;
script = ''
#!/usr/bin/env bash
diff --git a/hosts/underworld/network.nix b/hosts/underworld/network.nix
index 5b8380f..fe2986f 100644
--- a/hosts/underworld/network.nix
+++ b/hosts/underworld/network.nix
@@ -1,14 +1,11 @@
{
config,
- flakeRoot,
...
}:
let
secrets = config.sops.secrets;
in
{
- imports = [ (flakeRoot + /wireguard.nix) ];
-
sops = {
age.keyFile = "/var/lib/sops-nix/key.txt";
secrets."wireless.env" = {
diff --git a/secrets/wireguard/nyaan.txt b/secrets/wireguard/nyaan.txt
deleted file mode 100644
index 76f636d..0000000
--- a/secrets/wireguard/nyaan.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-{
- "data": "ENC[AES256_GCM,data:Ng3FR3cU6mjQqyOkDhk8S1HUa4sO/+exJn/B+IKMnTNtG80ZWWzy8PgFJqAg,iv:mAOZLP9PWYUNXySiclpgyo2ZSkcF0MpiUXqwtNGkPAY=,tag:MvHabqCi+bsrlNuN3CfkHw==,type:str]",
- "sops": {
- "age": [
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxOXZKYjNXWjJ2eEFQNXAw\naytCZlQ0REJuODcxZitZM2hnTmVmbGZRVnlNCmNPa3ZBcmRFcHkvY1FqQllYb2Jl\nMXR3U3lCOFl2T1V4WmJnWXFwckczR2sKLS0tIFNWUHdydFNBOGFCUmpwUUt5dkNR\nZW1qbGJqbFN0cWM2SVAycTlWeGRDeE0KjGJMYucpTHDdl6DpF4ZomyOe0N4RIy50\naLHNY1zahrw0QngMRGrRqkQO5TYwB1w9LAjaAY8A9t1UPTFv3dpayw==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk"
- },
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPcHNxREc0Q3hUVFY4c01n\nalBZbXhnNXlnVXV3TitQK1g3TFpMeE10cFIwCkZPNWVsOHViVUlmR2pyN3BtV3Zv\nQWcreVhuUzZtVXlkQTV3Y0pSWWVFM0kKLS0tIE1aWjd6Sm56Tzduckd6eXdMTjhw\naW9JSWQyRHhJQ09PY3V4c0xNSDZ5eFEKXmOmCQoav6GJ+t3qLlKRBxcARnkfzfY+\nUiKPZlELVtIR3Ph55XVwb+FXL73KSicJxV148LxGf9Bm67zK47tKyw==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc"
- },
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNd0VYMUQvbmFYUXFsenZP\naXI1R1hNQzI2d21BWEdhQmZ5SkdFRTVENlVVCnlNWXNPV2RVa3RPQWloa0xwOWV0\nTjFvd2J1OUF5TDd6eGx0K29WVXZmYzQKLS0tIHE4VkdLK0pJU01UQjVhc2NpSjBU\nTGFwS25hK3RHdWpKRVlMcmVaWWdDaFEKEwqGjZvO2WWrbIjp91qIh8T5OlHbhB4Y\nq8R4dMYhAiBGU/N8dFrEIZLhHVRmLamg7eipOOh+MvFXLweFhMcBqA==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern"
- },
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqUXNOUmZaY0RwTDlvRVdP\nWUJiL25jNThMMzlqYmlWMm1RM0JkNTFicFR3CnBGbEpQNTlwN2dEL1lLUEZ6T0lT\nNXRmTmlSTWIrMm9HekQ2Qm83SU1oZ0UKLS0tIEY4ODY0U2NvSUxUYWRZVXZqcjA0\nTlUrbHc1cVpsQkJzNDVZQ09BTWwzcTAK9+ybeJDwSIbHj5QmBazILaoBRRYkUE1i\n5PhvxBIvNcod05ZnTcvt3kMQMPTBe85cZQG1aaxnrIiKfVZeN8/o2Q==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6"
- }
- ],
- "lastmodified": "2026-05-30T09:55:51Z",
- "mac": "ENC[AES256_GCM,data:7eX5Kys9x65tk6+Kd0uTGgQXAoSuJnJ5V3D/eAN3gh9PrGjatc6Cqw45HPk6SqeYx7y6qCRK9ncdC3SYGX2vM2esREjQjgij9oNsKQvr7IKeb5QKB1rldwoPaWtsb6IfDnNew2nSPqaUw6R+K/hdMWKCfYFu5dGU0cbSoDH6DZ8=,iv:2YYQr7VtEnYn3UtgjovhKyCFAd3N/Xl+5+LwcPImJfo=,tag:nGTnUmabUaQUYYoeQLiNzQ==,type:str]",
- "version": "3.13.1"
- }
-}
diff --git a/secrets/wireguard/sagittarius.txt b/secrets/wireguard/sagittarius.txt
deleted file mode 100644
index 1cef967..0000000
--- a/secrets/wireguard/sagittarius.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-{
- "data": "ENC[AES256_GCM,data:OgzuAef2sEzf4cC7fHmmcUcdeiODfOwBS1IQ8/hN2MyrA+NqnVWYnpj9qR2J,iv:0JbA2r55QHJ7Qj8P6W3LKseimir/tciErWTeC82ln7Q=,tag:+mikffsQpyOqGC5PnFB0gw==,type:str]",
- "sops": {
- "age": [
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvM0NZVk9mdVo0Z3pJYyty\nMVV2eXNFVDM5SEVPS3BrSXl5S3IwRHE0a21vCnBHektiZDRvNDI3ZWovSjdFVDBG\nbnRLL2piekhiS1QrUitmY0tUMG1GSncKLS0tIEhvbTh6Nm1lamRrZ3MwNyt3THJJ\naVVFbnBNdkYzb3ZaazlUWnNWdlhjZ0UK+wp/uu7Q8XYoObBWKNqn4Nm8EOUBibpH\nkgvm8KE9mMFUMIbZILlO6yqPg/ppy2gBveboVgTvRCf9XlfHPj5RUg==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk"
- },
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5bnJ1RjM2SVpHUGtkd0Rh\nblpEK3JUdEVWKy9ZZjBobnYyL0FzSU8xRWdZCisxK3ZwNDBJL00wVVp3L3IyNU5H\nZzhsNzhIdGpPWG9ZelZXZ3hjRDF2WDgKLS0tIDNsejNLaHZ1L0FmYUFDK2tNWVFP\nMGpJRTFLUkpjOTFMRVovVVRvTEF1ckEKE7DNcRUIXSmYJEJj/J7eIlnD+6+BhDpM\nNHrrPywKyHlqG6IS8oNI3OXM6tEZC1SDJ8zrE8x5uFJb42CBCodqJg==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc"
- },
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRejJOSnRZZXFBUHFNMTQ0\nWGsxS2R6ZHUwVVRXVThKTmg3RVZyNmxHNUVrCkk4WU9Dc0hMV0xTb3dJd2R1enpH\nd1dyWmVxZmozMDBtWFdzSTF4cXpxNmcKLS0tIFBjeElqQzgzS01YanBabWxnUUti\nOUN3Yk45bGRlbHFoMmRHL0N3R01heW8KjcmdIpfVmRGaPVUuM75h2RvhmD88VnHy\n+ToQ58jIIq2ZhwCPGYtVvlBHiZjj57fp108BqfOZfBVuZlHBCmhUyQ==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern"
- },
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqcHh4MzF5RU51dWhuY3pV\nOTdKMFV3TjhBQk5sL25WQ2dOZTlQSndZUW00CjI1RjM0TUQxNkdreGdiWk9Ca2E3\nQ2JaOXN3RFUreDJITkFoL1dxelpob1kKLS0tIHV2QjdqcjdLS0ZnR3hCcFM5THN3\nR0VjVkw0UXdTdCsrM3dzQTc5TGVOWDAKYtZOzX9chjMRRE46d3tsjv8AGF1f1WZd\nFPSc32u0ZFrcnuQDrM/KRi1mfV8chNMSPI+521KdnqcUrBWUYn54Tw==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6"
- }
- ],
- "lastmodified": "2026-05-30T09:56:07Z",
- "mac": "ENC[AES256_GCM,data:3qOpDxLQUPGKtU4TqI5RxOPiAIUCZBdoBD97Cyj0yazqECOZya/vvPGuYa+iq8MrNTtCdN9Aa9oLnIP2VXfQRR8na2X6Isx423J17Y75g5Qujnz7Szt4Gzsazvardy6Ibuy/MSOmfBbO7PFJTP6pkpVH4ICggByON1WasusTNhw=,iv:h2OSF/uDJY2rhVFtUvPyYcyh+EqkAP38VJlT0R2clY0=,tag:XpoFAeRNxPhwTAWe+E+XPA==,type:str]",
- "version": "3.13.1"
- }
-}
diff --git a/secrets/wireguard/underworld.txt b/secrets/wireguard/underworld.txt
deleted file mode 100644
index 28526ea..0000000
--- a/secrets/wireguard/underworld.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-{
- "data": "ENC[AES256_GCM,data:PBD5K8RhSCVwkbOcl6GQ/EEmt9NRgy3NITLZ24crh94+6kxh7hZMHXpnPakv,iv:ZhotjNIf3VXpXFZvY2JtLhc/7PtQqzC74fO+FOIJ61A=,tag:bEVDBSuYqdT/R6y8H4XbXQ==,type:str]",
- "sops": {
- "age": [
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqNzRPWFdVbDB5OVlQZEhl\nYTNNVTREUjNjY3ljUUlTTDlkVytrOW0xYUdzCnNCaUtxbHRvSng0N0JhYVRHVFM4\nNk1JQXlKa0dDZHVTQ2ttaEU1TjBtZzQKLS0tIGt3dWxtRWdnYmtNcmhNR2lGMUV6\nRER6Q1k5UXBvUmdWTUxDSWxRdFNMNWMKHAAA4Y+5Mip29dDmC4GxD7rtfEhyxXO3\njWuH2PTgCq04g8kkV/j6yZbFW+FOiQYIfBAvMdWP1iMG+ZAmCgWr3g==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern"
- },
- {
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtelMvQzZ3VFovSUhIVU9Y\nWmZDTGFyVzVsd0l0eDF2RHNoR3MxTHFBZEc0ClAxMFlKaG1Eb2VCOVFtcVU2c3Q0\nMUh6Z3Vjc0dVb0QwenZwakNIRHY2bm8KLS0tIDJaeTM2VjdLZjFWb3NWbFczbjZC\nRmFkT3JQK2hZNUN0MFBVR010UGw5YzgKrrO/lOlhLYlE8hm6/G+nxKMGxDzrS4mG\nlsFyH4UUgXjOKZRp1LYz82R90lw6diNXaKfEBFqdZWuBMfCsrl22Fg==\n-----END AGE ENCRYPTED FILE-----\n",
- "recipient": "age1c8ff4rph28fvpy2e2kwh9m8hwrpyxzet75uhpxvxe90ncjcded5qmt64zq"
- }
- ],
- "lastmodified": "2026-08-02T10:35:41Z",
- "mac": "ENC[AES256_GCM,data:nA4gCWRG5Cix5TDJ79Nb4Psi8KkmBsaQU7sa8CLAPgw1Ma7mW2G5Lg0MLa9+QoUaiSycCtWMx+TJVZujb3UNWn86pzIRFkL23iJgrxc/VdQsa1lNv5idCItB2QVkyuT4iU399/pXlzsrrN+m4LrVqnhxn45j+RMUBBrqLKDVcCs=,iv:KAaY+848NHMGZg24S7G9EHbkSG9ilNdczU0mSwuD1SI=,tag:NuPo29TS4EHgTcUmo+JZ6w==,type:str]",
- "version": "3.13.3"
- }
-}
diff --git a/share/system/client-common.nix b/share/system/client-common.nix
index 1b36d42..1f6f378 100644
--- a/share/system/client-common.nix
+++ b/share/system/client-common.nix
@@ -34,8 +34,6 @@
};
};
- environment.systemPackages = [ pkgs.wireguard-tools ];
-
programs.nix-ld = {
enable = true;
libraries =
diff --git a/wireguard.nix b/wireguard.nix
deleted file mode 100644
index f6c696a..0000000
--- a/wireguard.nix
+++ /dev/null
@@ -1,112 +0,0 @@
-{ config, pkgs, ... }:
-let
- wgPort = 51820; # Common port used on all peers
- firewallMark = 42;
-
- inherit (pkgs) lib;
- inherit (lib.attrsets)
- mapAttrsToList
- ;
-
- # The topology is hub-and-spoke/star
- # sagittarius is the hub == 2301:db8:acad:a::1
- # it hosts authoritative DNS and spokes do keepalive with it.
- hub = {
- hostName = "sagittarius";
- address = "2301:db8:acad:a::1/128";
- publicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI=";
- endpoint = "95.216.136.85:${toString wgPort}";
- };
- spokes = {
- nyaan = {
- address = "2301:db8:acad:a::2/128";
- publicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0=";
- };
- pixel8 = {
- address = "2301:db8:acad:a::3/128";
- publicKey = "awBcQzNBdlYWpoOF1n7ijol2EiaJy5cxrVXfrqCvM0k=";
- };
- underworld = {
- address = "2301:db8:acad:a::4/128";
- publicKey = "GPVOvXqg8rp1a38T6YDHQN6UkG2TJT399A4wNtK4WTM=";
- };
- };
-
- generatePeer =
- hostname: values:
- {
- PublicKey = values.publicKey;
- AllowedIPs = [ values.address ];
- }
- // lib.optionalAttrs (builtins.hasAttr "endpoint" values) {
- Endpoint = values.endpoint;
- PersistentKeepalive = 1;
- };
-
- hubPeers = mapAttrsToList generatePeer spokes;
- spokePeers = [
- {
- PublicKey = hub.publicKey;
- AllowedIPs = [ "2301:db8:acad:a::/64" ];
- Endpoint = hub.endpoint;
- PersistentKeepalive = 10;
- }
- ];
-
- hostname = config.networking.hostName;
- isHub = hostname == hub.hostName;
- conf = if isHub then hub else spokes."${hostname}";
- privateKeyPath = ./secrets/wireguard/${hostname}.txt;
-in
-{
- sops.secrets."wireguard-${hostname}-pk" = {
- sopsFile = privateKeyPath;
- owner = "systemd-network";
- group = "systemd-network";
- mode = "0640";
- format = "binary";
- };
-
- networking.nameservers = [
- "2301:db8:acad:a::1" # see the zonefile in etc/dns
- ];
-
- systemd.network = {
- enable = true;
-
- networks."50-wg" = {
- matchConfig.Name = "wg0";
- address = [ conf.address ];
- networkConfig = lib.mkIf isHub {
- IPv6Forwarding = true;
- IPv6AcceptRA = false; # Disable RA acceptance on router interfaces
- };
- };
-
- netdevs."50-wg" = {
- netdevConfig = {
- Kind = "wireguard";
- Name = "wg0";
- };
-
- wireguardConfig = {
- ListenPort = wgPort;
- PrivateKeyFile = config.sops.secrets."wireguard-${hostname}-pk".path;
- # To automatically create routes for everything in AllowedIPs,
- # add RouteTable=main
- RouteTable = "main";
- # FirewallMark marks all packets send and received by wg0 with the
- # number, which can be used to define policy rules on these packets.
- FirewallMark = firewallMark;
- };
-
- wireguardPeers = if isHub then hubPeers else spokePeers;
- };
- };
-
- boot.kernel.sysctl = lib.mkIf isHub {
- # I *think* this should be fine since networkd will prevent forwarding
- # on any interface that doesn't have IPv6Forwarding set to true.
- "net.ipv6.conf.wg0.forwarding" = true;
- };
-}
generated by cgit v1.3.1 (git 2.54.0) at 2026-10-27 09:23:38 +0000