diff options
| -rw-r--r-- | broken_stuff | 10 | ||||
| -rw-r--r-- | hosts.toml | 3 | ||||
| -rw-r--r-- | hosts/ganymede/config.nix | 2 | ||||
| -rw-r--r-- | hosts/ganymede/networking.nix | 12 | ||||
| -rw-r--r-- | hosts/ganymede/secrets/caddy-env.age | 21 | ||||
| -rw-r--r-- | hosts/ganymede/secrets/wg-privkey.age | 19 | ||||
| -rw-r--r-- | hosts/ganymede/secrets/williams-psk.age | 17 | ||||
| -rw-r--r-- | hosts/ganymede/wireguard.nix | 14 | ||||
| -rw-r--r-- | hosts/mercury/nixos.nix | 6 | ||||
| -rw-r--r-- | hosts/mercury/secrets/wg-privkey.age | 14 | ||||
| -rw-r--r-- | hosts/mercury/wireguard.nix | 15 | ||||
| -rw-r--r-- | modules/system/nixos/boot.nix | 5 | ||||
| -rw-r--r-- | modules/terminal/nixos/github-ssh-key.age | bin | 885 -> 1271 bytes | |||
| -rw-r--r-- | secrets.nix | 4 |
14 files changed, 65 insertions, 77 deletions
diff --git a/broken_stuff b/broken_stuff deleted file mode 100644 index 935a33b..0000000 --- a/broken_stuff +++ /dev/null @@ -1,10 +0,0 @@ -idea: - - tmux - - projects are sessions (but ditch old sessionizer) - - new session with C-x C-n or whatever - - opens new session with broot window - - broot window controls entire session - - selecting dir changes session dir - - <enter> on file opens it in new tmux window - - use standard join-pane split-pane for splitting stuff - - alt-t creates new terminal pane within session with dir = session dir @@ -8,7 +8,8 @@ wg_ip = "10.100.0.5" [hosts.ganymede] hostnames = ["ganymede", "192.168.50.2", "williamsfam.us.com"] user_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeAsRh11Jyv+7Fm4WhzV4XN0LMYQS1/yMbvT+pvFDcd collin@ganymede" -host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9" +# host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlr+53UmlGVP1blkdNl6NFqn1w2umFJyjH1EVUPKIy9" +host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL9ogXwOPZbAyAq9ecuzJGeRXobWrT9I7icHeEKnpzwB" wg_pubkey = "7BdBTJ/FQUOPjSU+Q1Ieg9VqMd2y8BCMqk61I5rMAnY=" wg_ip = "10.100.0.1" diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index 92eddee..8964666 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -24,7 +24,7 @@ userEmail = "96917990+bluedragon1221@users.noreply.github.com"; installKey = true; }; - helix.enable = true; + # helix.enable = true; }; }; diff --git a/hosts/ganymede/networking.nix b/hosts/ganymede/networking.nix index 082068c..42a66c7 100644 --- a/hosts/ganymede/networking.nix +++ b/hosts/ganymede/networking.nix @@ -6,7 +6,7 @@ }: let static = { ssid = "williams"; - pskFile = config.collinux.secrets."williams-psk".path; + pskFile = config.collinux.secrets."williams-psk".path; # file should look like "psk=<PSK>" ip = "192.168.50.2/24"; gateway = "192.168.50.1"; }; @@ -28,8 +28,8 @@ in { wireless = { enable = true; - networks.${static.ssid}.pskRaw = "ext:psk"; secretsFile = static.pskFile; + networks.${static.ssid}.pskRaw = "ext:psk"; }; }; systemd = { @@ -55,6 +55,14 @@ in { DHCP = "no"; }; }; + + networks."20-teather" = { + # for next time I break networking... + name = "enp*"; + networkConfig = { + DHCP = "yes"; + }; + }; }; }; diff --git a/hosts/ganymede/secrets/caddy-env.age b/hosts/ganymede/secrets/caddy-env.age index ecfc05a..4594116 100644 --- a/hosts/ganymede/secrets/caddy-env.age +++ b/hosts/ganymede/secrets/caddy-env.age @@ -1,7 +1,14 @@ -age-encryption.org/v1 --> ssh-ed25519 Jg4yWQ t4jtOOcuC4v735Yi4FzdDnvjQFNYVgzMluuH7H3oxx4 -qLKbZ3wA3kk7UXqwUJN2HH+6Wr3qgzINNwLx+dbgsIg ---- im4dvpbhdvB7fwa8QJ7clFZ+5aVIaXld/gPlhUalc14 ->u4BECQD:3kkKļc}}}mK)HM3v}ܣI9Ikxr1s?"8Д>J{uafϚ}.3Oa9m2- @C0b
X|]:9`WX1ba|W2=l]Cw U&~"0 ! -6 -MFίp D˅+ q
`-R6/L 4
\ No newline at end of file +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyBXQmV1 +SGtxc1FQNmJPUWp5YnJ4N2p6Rm9wQXlWL0o0aCtJZHZ0SEtlM3pZCnpaOTJwOVI5 +QmVURmlkeUJJNFA3TGIrTVRxTnRKQ2RGbnlwdFlCQVRZcWsKLT4gc3NoLWVkMjU1 +MTkgWkVyTFRnIHlqMUxERmpWV0FEZGlISEdCWjYvS0RSTzhWMGFaeFRRVXovNVVn +alArVDQKR0ZmSkxJMnZvR1RSZTdUME5kS3hDcFNTRFdrWThBYVpLTElHKzJaVUpN +SQotPiAuZURHcjotZ3JlYXNlIFInayBnbmxgNCBJNUtxUVEKNnhZQUV4M2x4cUR1 +V0phYTl0T2ZSWk9QVWhZVkkwR25QTnhwYUEKLS0tIGdjSGJjWk5BQXhhQVhjR1NP +Tnp1WDgvb3BNcTgwRHAwa05nVkFOK3JCUlkK6q+7svteLgBqzY5O/frqV8DqoPu7 +NIJ1foAVc30dn88iCDJxde5/Bb1bGNd+LROFiVFKdi8pOLdCEMKZlXui1YpDC+9b +l2mFT/uaWm4rqPgO+hRIr83Am3E84bLJHsCpffmkQ9m05J1MNVeZiiwU+sI3mLOF +sdl7sIT0g6diXSuIoM+Oh2C1uAl5tDJu7ORKSUgiwPNGwUQB94ukLlBkS9vGKXdM +oUgEoyjkSlrfGq1yG50CTA9keS5DbXtWuImNvquHqZgGZ4L5fsP8XH+vJxw= +-----END AGE ENCRYPTED FILE----- diff --git a/hosts/ganymede/secrets/wg-privkey.age b/hosts/ganymede/secrets/wg-privkey.age index 398a4b2..842856d 100644 --- a/hosts/ganymede/secrets/wg-privkey.age +++ b/hosts/ganymede/secrets/wg-privkey.age @@ -1,12 +1,11 @@ -----BEGIN AGE ENCRYPTED FILE----- -YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyBQS20w -cEVsZkNQN3pkNm5mLzhIbEQ0ejVmcG9Md1d5YWd4WXBKa0tON3lZCk80a2lmQ3Zw -ZGlCRjZwdG5GY25RWFZrMktZYVZoWHZMeHFHUnJXSUlFa2sKLT4gc3NoLWVkMjU1 -MTkgSmc0eVdRIEIvcGNuVDVJWHV5UHpNMklXME1Sd2drNDYrTVk5aFUrbUN5SVVT -dVhSVEUKRG92b2NxZ0oxT3h0UGttZmhHb3gxT1VIMFVzOUQvSCt5RGEyL2NSRmp5 -SQotPiB2fGhLSSQuLWdyZWFzZQo5WlBvV1pWRkkvaTRHS0lha0R5R3A0cFFJbm04 -cTNGamZMNnlFMkZndy9QTlFlckZBd2J2eWt6R3l6MTVER0RQCkdrbG10bTRyMTZi -cQotLS0gazNldzNoSU1VOFdCTklsRFhjNVF6a2d5YlA2Q3gxdUVNbFFwU0dRSGhK -WQosSz+PG1ZS0BTINC2BVnJLFApgLIpos8pYgQz7MYdtcVrOSbhRA1VKxGT1zy3p -7o4Eu4MYzC9a7qmq547UKN0sjHhDRlmi9aH7zshN2A== +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyA5Ti9M +Q2E5S2EyWHdjaUpCUGdYeWxzSzQ4MDVlZXN5UGhJeWlCL1FmWHdnCkdrZ3JtNmhN +UTFzaHYvMlpXbGxWWktjZ3g5TlpJQlNhN2JpVFF6Tjc5M1EKLT4gc3NoLWVkMjU1 +MTkgWkVyTFRnIGoxUHVNMEl2YWt2LzVVUCtZR2dPS2lKc3hGbGYzdy9DT1RTcVc1 +aXRZMjAKazlkcUZJT1lwbmdCVDY5OTZiVnpzWXVzdW9ZdnptYjBvUGk5MXo1dmNP +NAotPiAqNz0sXS1ncmVhc2UgSklHenpAJDMgUVIjPW4gNlRLe2QgYlM4KUkKT25y +NUJNRENXNWMKLS0tIGZhY0RXclQ2Y04yYXRpdlNzYlVOdkt6Mm9Nd3F2dWVIVWFE +S1AyVHlOSncKDAUyAaiOe9CBbSKZ3T7fo6uSoSLEAXBpYnuJgwZtR3bq6/L5aQwy +fZJpr7jwr6AblYx8LweS2Z0mIDWpDsaR8rjo+I14djnaXNuHECk= -----END AGE ENCRYPTED FILE----- diff --git a/hosts/ganymede/secrets/williams-psk.age b/hosts/ganymede/secrets/williams-psk.age index 1f26949..b7ba4f1 100644 --- a/hosts/ganymede/secrets/williams-psk.age +++ b/hosts/ganymede/secrets/williams-psk.age @@ -1,5 +1,12 @@ -age-encryption.org/v1 --> ssh-ed25519 Jg4yWQ x4yUAZMn9eCey8YxPpdecYM/gjL81nLx8knzQcZDlV0 -5me7Z8K2hvNyTNY80GUM+rB9trko2x1MyUHRmCXl9vA ---- sQ2n7Rc6fd4QqfibSvSJGvTCKXygTeas4rVBlUXreVE -|wB AB:B-=VD}Epnq
\ No newline at end of file +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyBzb214 +a3c5eEF1cmpMcmxRYytnbnM2Y01DeTdPYW9rMjl4elBaYW5NWTFZCk9raEhIclhm +TE01a2JyVVZzTHpZeUF6ZW9kMFlZdmFNZkhXT0dTSkQ5a1kKLT4gc3NoLWVkMjU1 +MTkgWkVyTFRnIEVYblV0bGd6RWN4ei9kaDgzdlpCOGpyaGFoSzFTK1ZzQzRIdjdr +SXlnbTQKOHJJSHM5ck1PRENOUzBsZ0llZGJWd2lRNkoxL3ROQ1BqYVlVWnRDekpk +OAotPiBBQGg3XiItZ3JlYXNlIFZGWE1VZFtwClZieXlwdXg4Sy9raHNsYWZ4KzdU +T3FhTTA2L25zQTFNVnBoRVRPa2VWd1RHRHd5SjRRajdEVEpQVlAvTlF6ZFkKaENw +SAotLS0gL1E1VmFsdWNsMVdoNUxxaVdoSzdCblc4ZmZaSkhVd3NPU2JwZ3dlM3Ez +OAqc9LxEX2YGoyf8tdQJd1d+vF2lKyjOPVSGLY10L+wP61olt4MpicKDqutY+IUH +PjM= +-----END AGE ENCRYPTED FILE----- diff --git a/hosts/ganymede/wireguard.nix b/hosts/ganymede/wireguard.nix index 3c3f1d6..27d50bb 100644 --- a/hosts/ganymede/wireguard.nix +++ b/hosts/ganymede/wireguard.nix @@ -11,24 +11,10 @@ networking.firewall = { allowedUDPPorts = [51820]; - allowedTCPPorts = [51843]; trustedInterfaces = ["wg0"]; }; - systemd.services.udp2raw-server = { - description = "udp2raw WireGuard transport"; - wantedBy = ["multi-user.target"]; - after = ["network-online.target"]; - wants = ["network-online.target"]; - - serviceConfig = { - ExecStart = "${lib.getExe pkgs.udp2raw} -s -l 0.0.0.0:51843 -r 127.0.0.1:51820 -k shared-secret -a"; - Restart = "on-failure"; - RestartSec = "2s"; - }; - }; - systemd.network.netdevs."50-wg0" = { netdevConfig = { Kind = "wireguard"; diff --git a/hosts/mercury/nixos.nix b/hosts/mercury/nixos.nix index 4fe5756..02d4b96 100644 --- a/hosts/mercury/nixos.nix +++ b/hosts/mercury/nixos.nix @@ -37,6 +37,12 @@ '' ]; + # get perl out of my closure + system = { + etc.overlay.enable = true; + nixos-init.enable = true; + }; + # required for vm testing virtualisation.vmVariant.virtualisation.diskSize = 8192; } diff --git a/hosts/mercury/secrets/wg-privkey.age b/hosts/mercury/secrets/wg-privkey.age index 767692f..2481e9d 100644 --- a/hosts/mercury/secrets/wg-privkey.age +++ b/hosts/mercury/secrets/wg-privkey.age @@ -1,9 +1,9 @@ -----BEGIN AGE ENCRYPTED FILE----- -YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyA0L2Ry -ZXZFOUxvL25CemdScnhEc3Ewb0NVUnBCNHZ5WjlNaDgwMVQxL0VzCmFoWTlQM0N6 -aFBSK05qZ3pKazF1a1BhRDBudkUwQmVpOHNsemUzazV4REkKLT4gbTtrJiw4Qy1n -cmVhc2UKazJ3UW9zQmh6RlBlTmpmekduUlpMSHl4TGgvcUJKTnB6aE43YTJDR2Vm -SHZVMGsKLS0tIFpnV21lOE9ZYUtwUFBVeGFWRDVMNFpkSStsSmpIaWZ3MHJVL29G -dzA2SXMKuuAvweyyyuIFVJftn6tNANBkHp0NGxJZ0LXTj+daziYleOUFn3R1KTVu -0UMQIZM/WsfesWXkvN1E4+LZKTdNdJOsEJv9ahYnk8btBgU= +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyBLUTBt +akJEZ0ZVckVBcEZaTDVWVkFxamdiKzJ2YzNmUXdQeDVxMjU5dW1vCnRvbk5pYlN4 +RElqb2ZBWXAvZExrUnJMSUhYWmg3cVhUeW5kcnBiWTZDL1UKLT4gPW9TLWdyZWFz +ZSB5LUQwfWB8SiAxQ1ImWVh+YApub2lGeXFYcQotLS0gbE1CeDdLY2MrTmxsVk1M +d215U1NxZU9rREd1Q1ZxcnhOU0Y1aWQ4VXg3WQp7WxGRBQEKrLBaSLoT/scxELxz +JCVXaaQxbpaYO+uMh5pSxmDmvZHXJiFKydwOJbaLLG6wlD+Y4mG5aThXDHXU+itJ +aYhvR8ptpYGY8A== -----END AGE ENCRYPTED FILE----- diff --git a/hosts/mercury/wireguard.nix b/hosts/mercury/wireguard.nix index 105d10b..1035a0e 100644 --- a/hosts/mercury/wireguard.nix +++ b/hosts/mercury/wireguard.nix @@ -7,19 +7,6 @@ }: { environment.systemPackages = [pkgs.wireguard-tools]; - systemd.services.udp2raw-client = { - description = "udp2raw WireGuard transport"; - wantedBy = ["multi-user.target"]; - after = ["network-online.target"]; - wants = ["network-online.target"]; - - serviceConfig = { - ExecStart = "${lib.getExe pkgs.udp2raw} -c -l 127.0.0.1:51820 -r 70.130.121.193:51843 -k shared-secret -a"; - Restart = "on-failure"; - RestartSec = "2s"; - }; - }; - systemd.network.netdevs."10-wg" = { netdevConfig = { Kind = "wireguard"; @@ -34,7 +21,7 @@ { PublicKey = hosts.ganymede.wg_pubkey; AllowedIPs = ["10.100.0.0/24"]; - Endpoint = "127.0.0.1:51820"; + Endpoint = "williamsfam.us.com:51820"; } ]; }; diff --git a/modules/system/nixos/boot.nix b/modules/system/nixos/boot.nix index 3b095ab..48e3e22 100644 --- a/modules/system/nixos/boot.nix +++ b/modules/system/nixos/boot.nix @@ -21,7 +21,7 @@ in { configurationLimit = 3; }; efi.canTouchEfiVariables = true; - timeout = cfg.timeout; # hold space to show boot menu if timeout == 0 + timeout = cfg.timeout; # hold space to show boot menu if timeout == 0 (`systemctl reboot --boot-loader-menu=0` reboots with the bootloader showing) }; plymouth = lib.mkIf cfg.plymouth.enable { @@ -74,9 +74,6 @@ in { }; }); - # system.etc.overlay.enable = true; - system.nixos-init.enable = true; - # store journald logs in memory services.journald.extraConfig = '' Storage=volatile diff --git a/modules/terminal/nixos/github-ssh-key.age b/modules/terminal/nixos/github-ssh-key.age Binary files differindex a6064b4..08d57a7 100644 --- a/modules/terminal/nixos/github-ssh-key.age +++ b/modules/terminal/nixos/github-ssh-key.age diff --git a/secrets.nix b/secrets.nix index e900b8c..461dbb7 100644 --- a/secrets.nix +++ b/secrets.nix @@ -3,8 +3,8 @@ let in { "modules/terminal/nixos/github-ssh-key.age".publicKeys = [mercury.host_pubkey ganymede.host_pubkey]; - "hosts/ganymede/secrets/caddy-env.age".publicKeys = [ganymede.host_pubkey]; - "hosts/ganymede/secrets/williams-psk.age".publicKeys = [ganymede.host_pubkey]; + "hosts/ganymede/secrets/caddy-env.age".publicKeys = [mercury.host_pubkey ganymede.host_pubkey]; + "hosts/ganymede/secrets/williams-psk.age".publicKeys = [mercury.host_pubkey ganymede.host_pubkey]; "hosts/mercury/secrets/wg-privkey.age".publicKeys = [mercury.host_pubkey]; "hosts/ganymede/secrets/wg-privkey.age".publicKeys = [mercury.host_pubkey ganymede.host_pubkey]; |