rekey a bunch of secrets, other stuff

6 files changed, 46 insertions, 39 deletions

diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix
index 92eddee..8964666 100644
--- a/hosts/ganymede/config.nix
+++ b/hosts/ganymede/config.nix
@@ -24,7 +24,7 @@
           userEmail = "96917990+bluedragon1221@users.noreply.github.com";
           installKey = true;
         };
-        helix.enable = true;
+        # helix.enable = true;
       };
     };
 
diff --git a/hosts/ganymede/networking.nix b/hosts/ganymede/networking.nix
index 082068c..42a66c7 100644
--- a/hosts/ganymede/networking.nix
+++ b/hosts/ganymede/networking.nix
@@ -6,7 +6,7 @@
 }: let
   static = {
     ssid = "williams";
-    pskFile = config.collinux.secrets."williams-psk".path;
+    pskFile = config.collinux.secrets."williams-psk".path; # file should look like "psk=<PSK>"
     ip = "192.168.50.2/24";
     gateway = "192.168.50.1";
   };
@@ -28,8 +28,8 @@ in {
 
     wireless = {
       enable = true;
-      networks.${static.ssid}.pskRaw = "ext:psk";
       secretsFile = static.pskFile;
+      networks.${static.ssid}.pskRaw = "ext:psk";
     };
   };
   systemd = {
@@ -55,6 +55,14 @@ in {
           DHCP = "no";
         };
       };
+
+      networks."20-teather" = {
+        # for next time I break networking...
+        name = "enp*";
+        networkConfig = {
+          DHCP = "yes";
+        };
+      };
     };
   };
 
diff --git a/hosts/ganymede/secrets/caddy-env.age b/hosts/ganymede/secrets/caddy-env.age
index ecfc05a..4594116 100644
--- a/hosts/ganymede/secrets/caddy-env.age
+++ b/hosts/ganymede/secrets/caddy-env.age
@@ -1,7 +1,14 @@
-age-encryption.org/v1
--> ssh-ed25519 Jg4yWQ t4jtOOcuC4v735Yi4FzdDnvjQFNYVgzMluuH7H3oxx4
-qLKbZ3wA3kk7UXqwUJN2HH+6Wr3qgzINNwLx+dbgsIg
---- im4dvpbhdvB7fwa8QJ7clFZ+5aVIaXld/gPlhUalc14
-�>�u���4�B�E���C��Q�D:��3k��k����K���ļc}}}��m�K)�HM�3v}ܣ�I�9�I��kxr��1�s��?��"8����������Д�>J{�����ua������fϚ��}�.��3�Oa�9��m�2�-�@C�0�b
�X��|]��:�������9��`�W������X�1�b��a�|��W2=�l�]C�w��U&~"�0! 
-�6
-�����MF�ίp	D˅��+����q�
`��-R6/���L�	4
\ No newline at end of file
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyBXQmV1
+SGtxc1FQNmJPUWp5YnJ4N2p6Rm9wQXlWL0o0aCtJZHZ0SEtlM3pZCnpaOTJwOVI5
+QmVURmlkeUJJNFA3TGIrTVRxTnRKQ2RGbnlwdFlCQVRZcWsKLT4gc3NoLWVkMjU1
+MTkgWkVyTFRnIHlqMUxERmpWV0FEZGlISEdCWjYvS0RSTzhWMGFaeFRRVXovNVVn
+alArVDQKR0ZmSkxJMnZvR1RSZTdUME5kS3hDcFNTRFdrWThBYVpLTElHKzJaVUpN
+SQotPiAuZURHcjotZ3JlYXNlIFInayBnbmxgNCBJNUtxUVEKNnhZQUV4M2x4cUR1
+V0phYTl0T2ZSWk9QVWhZVkkwR25QTnhwYUEKLS0tIGdjSGJjWk5BQXhhQVhjR1NP
+Tnp1WDgvb3BNcTgwRHAwa05nVkFOK3JCUlkK6q+7svteLgBqzY5O/frqV8DqoPu7
+NIJ1foAVc30dn88iCDJxde5/Bb1bGNd+LROFiVFKdi8pOLdCEMKZlXui1YpDC+9b
+l2mFT/uaWm4rqPgO+hRIr83Am3E84bLJHsCpffmkQ9m05J1MNVeZiiwU+sI3mLOF
+sdl7sIT0g6diXSuIoM+Oh2C1uAl5tDJu7ORKSUgiwPNGwUQB94ukLlBkS9vGKXdM
+oUgEoyjkSlrfGq1yG50CTA9keS5DbXtWuImNvquHqZgGZ4L5fsP8XH+vJxw=
+-----END AGE ENCRYPTED FILE-----
diff --git a/hosts/ganymede/secrets/wg-privkey.age b/hosts/ganymede/secrets/wg-privkey.age
index 398a4b2..842856d 100644
--- a/hosts/ganymede/secrets/wg-privkey.age
+++ b/hosts/ganymede/secrets/wg-privkey.age
@@ -1,12 +1,11 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyBQS20w
-cEVsZkNQN3pkNm5mLzhIbEQ0ejVmcG9Md1d5YWd4WXBKa0tON3lZCk80a2lmQ3Zw
-ZGlCRjZwdG5GY25RWFZrMktZYVZoWHZMeHFHUnJXSUlFa2sKLT4gc3NoLWVkMjU1
-MTkgSmc0eVdRIEIvcGNuVDVJWHV5UHpNMklXME1Sd2drNDYrTVk5aFUrbUN5SVVT
-dVhSVEUKRG92b2NxZ0oxT3h0UGttZmhHb3gxT1VIMFVzOUQvSCt5RGEyL2NSRmp5
-SQotPiB2fGhLSSQuLWdyZWFzZQo5WlBvV1pWRkkvaTRHS0lha0R5R3A0cFFJbm04
-cTNGamZMNnlFMkZndy9QTlFlckZBd2J2eWt6R3l6MTVER0RQCkdrbG10bTRyMTZi
-cQotLS0gazNldzNoSU1VOFdCTklsRFhjNVF6a2d5YlA2Q3gxdUVNbFFwU0dRSGhK
-WQosSz+PG1ZS0BTINC2BVnJLFApgLIpos8pYgQz7MYdtcVrOSbhRA1VKxGT1zy3p
-7o4Eu4MYzC9a7qmq547UKN0sjHhDRlmi9aH7zshN2A==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyA5Ti9M
+Q2E5S2EyWHdjaUpCUGdYeWxzSzQ4MDVlZXN5UGhJeWlCL1FmWHdnCkdrZ3JtNmhN
+UTFzaHYvMlpXbGxWWktjZ3g5TlpJQlNhN2JpVFF6Tjc5M1EKLT4gc3NoLWVkMjU1
+MTkgWkVyTFRnIGoxUHVNMEl2YWt2LzVVUCtZR2dPS2lKc3hGbGYzdy9DT1RTcVc1
+aXRZMjAKazlkcUZJT1lwbmdCVDY5OTZiVnpzWXVzdW9ZdnptYjBvUGk5MXo1dmNP
+NAotPiAqNz0sXS1ncmVhc2UgSklHenpAJDMgUVIjPW4gNlRLe2QgYlM4KUkKT25y
+NUJNRENXNWMKLS0tIGZhY0RXclQ2Y04yYXRpdlNzYlVOdkt6Mm9Nd3F2dWVIVWFE
+S1AyVHlOSncKDAUyAaiOe9CBbSKZ3T7fo6uSoSLEAXBpYnuJgwZtR3bq6/L5aQwy
+fZJpr7jwr6AblYx8LweS2Z0mIDWpDsaR8rjo+I14djnaXNuHECk=
 -----END AGE ENCRYPTED FILE-----
diff --git a/hosts/ganymede/secrets/williams-psk.age b/hosts/ganymede/secrets/williams-psk.age
index 1f26949..b7ba4f1 100644
--- a/hosts/ganymede/secrets/williams-psk.age
+++ b/hosts/ganymede/secrets/williams-psk.age
@@ -1,5 +1,12 @@
-age-encryption.org/v1
--> ssh-ed25519 Jg4yWQ x4yUAZMn9eCey8YxPpdecYM/gjL81nLx8knzQcZDlV0
-5me7Z8K2hvNyTNY80GUM+rB9trko2x1MyUHRmCXl9vA
---- sQ2n7Rc6fd4QqfibSvSJGvTCKXygTeas4rVBlUXreVE
-�����|w��B��A���B�:B-�=��VD؄��}�����Ep�n��q
\ No newline at end of file
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyBzb214
+a3c5eEF1cmpMcmxRYytnbnM2Y01DeTdPYW9rMjl4elBaYW5NWTFZCk9raEhIclhm
+TE01a2JyVVZzTHpZeUF6ZW9kMFlZdmFNZkhXT0dTSkQ5a1kKLT4gc3NoLWVkMjU1
+MTkgWkVyTFRnIEVYblV0bGd6RWN4ei9kaDgzdlpCOGpyaGFoSzFTK1ZzQzRIdjdr
+SXlnbTQKOHJJSHM5ck1PRENOUzBsZ0llZGJWd2lRNkoxL3ROQ1BqYVlVWnRDekpk
+OAotPiBBQGg3XiItZ3JlYXNlIFZGWE1VZFtwClZieXlwdXg4Sy9raHNsYWZ4KzdU
+T3FhTTA2L25zQTFNVnBoRVRPa2VWd1RHRHd5SjRRajdEVEpQVlAvTlF6ZFkKaENw
+SAotLS0gL1E1VmFsdWNsMVdoNUxxaVdoSzdCblc4ZmZaSkhVd3NPU2JwZ3dlM3Ez
+OAqc9LxEX2YGoyf8tdQJd1d+vF2lKyjOPVSGLY10L+wP61olt4MpicKDqutY+IUH
+PjM=
+-----END AGE ENCRYPTED FILE-----
diff --git a/hosts/ganymede/wireguard.nix b/hosts/ganymede/wireguard.nix
index 3c3f1d6..27d50bb 100644
--- a/hosts/ganymede/wireguard.nix
+++ b/hosts/ganymede/wireguard.nix
@@ -11,24 +11,10 @@
 
   networking.firewall = {
     allowedUDPPorts = [51820];
-    allowedTCPPorts = [51843];
 
     trustedInterfaces = ["wg0"];
   };
 
-  systemd.services.udp2raw-server = {
-    description = "udp2raw WireGuard transport";
-    wantedBy = ["multi-user.target"];
-    after = ["network-online.target"];
-    wants = ["network-online.target"];
-
-    serviceConfig = {
-      ExecStart = "${lib.getExe pkgs.udp2raw} -s -l 0.0.0.0:51843 -r 127.0.0.1:51820 -k shared-secret -a";
-      Restart = "on-failure";
-      RestartSec = "2s";
-    };
-  };
-
   systemd.network.netdevs."50-wg0" = {
     netdevConfig = {
       Kind = "wireguard";