From 967ec14cba166079d71d67f4137ee62fca315d62 Mon Sep 17 00:00:00 2001 From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com> Date: Thu, 20 Aug 2026 12:34:03 -0500 Subject: rekey a bunch of secrets, other stuff --- hosts/ganymede/config.nix | 2 +- hosts/ganymede/networking.nix | 12 ++++++++++-- hosts/ganymede/secrets/caddy-env.age | 21 ++++++++++++++------- hosts/ganymede/secrets/wg-privkey.age | 19 +++++++++---------- hosts/ganymede/secrets/williams-psk.age | 17 ++++++++++++----- hosts/ganymede/wireguard.nix | 14 -------------- 6 files changed, 46 insertions(+), 39 deletions(-) (limited to 'hosts/ganymede') diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index 92eddee..8964666 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -24,7 +24,7 @@ userEmail = "96917990+bluedragon1221@users.noreply.github.com"; installKey = true; }; - helix.enable = true; + # helix.enable = true; }; }; diff --git a/hosts/ganymede/networking.nix b/hosts/ganymede/networking.nix index 082068c..42a66c7 100644 --- a/hosts/ganymede/networking.nix +++ b/hosts/ganymede/networking.nix @@ -6,7 +6,7 @@ }: let static = { ssid = "williams"; - pskFile = config.collinux.secrets."williams-psk".path; + pskFile = config.collinux.secrets."williams-psk".path; # file should look like "psk=" ip = "192.168.50.2/24"; gateway = "192.168.50.1"; }; @@ -28,8 +28,8 @@ in { wireless = { enable = true; - networks.${static.ssid}.pskRaw = "ext:psk"; secretsFile = static.pskFile; + networks.${static.ssid}.pskRaw = "ext:psk"; }; }; systemd = { @@ -55,6 +55,14 @@ in { DHCP = "no"; }; }; + + networks."20-teather" = { + # for next time I break networking... + name = "enp*"; + networkConfig = { + DHCP = "yes"; + }; + }; }; }; diff --git a/hosts/ganymede/secrets/caddy-env.age b/hosts/ganymede/secrets/caddy-env.age index ecfc05a..4594116 100644 --- a/hosts/ganymede/secrets/caddy-env.age +++ b/hosts/ganymede/secrets/caddy-env.age @@ -1,7 +1,14 @@ -age-encryption.org/v1 --> ssh-ed25519 Jg4yWQ t4jtOOcuC4v735Yi4FzdDnvjQFNYVgzMluuH7H3oxx4 -qLKbZ3wA3kk7UXqwUJN2HH+6Wr3qgzINNwLx+dbgsIg ---- im4dvpbhdvB7fwa8QJ7clFZ+5aVIaXld/gPlhUalc14 ->u4BECQD:3kkKļc}}}mK)HM3v}ܣI9Ikxr1s?"8Д>J{uafϚ}.3Oa9m2- @C0b X|]:9`WX1ba|W2=l]Cw U&~"0 ! -6 -MFίp D˅+q `-R6/L 4 \ No newline at end of file +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyBXQmV1 +SGtxc1FQNmJPUWp5YnJ4N2p6Rm9wQXlWL0o0aCtJZHZ0SEtlM3pZCnpaOTJwOVI5 +QmVURmlkeUJJNFA3TGIrTVRxTnRKQ2RGbnlwdFlCQVRZcWsKLT4gc3NoLWVkMjU1 +MTkgWkVyTFRnIHlqMUxERmpWV0FEZGlISEdCWjYvS0RSTzhWMGFaeFRRVXovNVVn +alArVDQKR0ZmSkxJMnZvR1RSZTdUME5kS3hDcFNTRFdrWThBYVpLTElHKzJaVUpN +SQotPiAuZURHcjotZ3JlYXNlIFInayBnbmxgNCBJNUtxUVEKNnhZQUV4M2x4cUR1 +V0phYTl0T2ZSWk9QVWhZVkkwR25QTnhwYUEKLS0tIGdjSGJjWk5BQXhhQVhjR1NP +Tnp1WDgvb3BNcTgwRHAwa05nVkFOK3JCUlkK6q+7svteLgBqzY5O/frqV8DqoPu7 +NIJ1foAVc30dn88iCDJxde5/Bb1bGNd+LROFiVFKdi8pOLdCEMKZlXui1YpDC+9b +l2mFT/uaWm4rqPgO+hRIr83Am3E84bLJHsCpffmkQ9m05J1MNVeZiiwU+sI3mLOF +sdl7sIT0g6diXSuIoM+Oh2C1uAl5tDJu7ORKSUgiwPNGwUQB94ukLlBkS9vGKXdM +oUgEoyjkSlrfGq1yG50CTA9keS5DbXtWuImNvquHqZgGZ4L5fsP8XH+vJxw= +-----END AGE ENCRYPTED FILE----- diff --git a/hosts/ganymede/secrets/wg-privkey.age b/hosts/ganymede/secrets/wg-privkey.age index 398a4b2..842856d 100644 --- a/hosts/ganymede/secrets/wg-privkey.age +++ b/hosts/ganymede/secrets/wg-privkey.age @@ -1,12 +1,11 @@ -----BEGIN AGE ENCRYPTED FILE----- -YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyBQS20w -cEVsZkNQN3pkNm5mLzhIbEQ0ejVmcG9Md1d5YWd4WXBKa0tON3lZCk80a2lmQ3Zw -ZGlCRjZwdG5GY25RWFZrMktZYVZoWHZMeHFHUnJXSUlFa2sKLT4gc3NoLWVkMjU1 -MTkgSmc0eVdRIEIvcGNuVDVJWHV5UHpNMklXME1Sd2drNDYrTVk5aFUrbUN5SVVT -dVhSVEUKRG92b2NxZ0oxT3h0UGttZmhHb3gxT1VIMFVzOUQvSCt5RGEyL2NSRmp5 -SQotPiB2fGhLSSQuLWdyZWFzZQo5WlBvV1pWRkkvaTRHS0lha0R5R3A0cFFJbm04 -cTNGamZMNnlFMkZndy9QTlFlckZBd2J2eWt6R3l6MTVER0RQCkdrbG10bTRyMTZi -cQotLS0gazNldzNoSU1VOFdCTklsRFhjNVF6a2d5YlA2Q3gxdUVNbFFwU0dRSGhK -WQosSz+PG1ZS0BTINC2BVnJLFApgLIpos8pYgQz7MYdtcVrOSbhRA1VKxGT1zy3p -7o4Eu4MYzC9a7qmq547UKN0sjHhDRlmi9aH7zshN2A== +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyA5Ti9M +Q2E5S2EyWHdjaUpCUGdYeWxzSzQ4MDVlZXN5UGhJeWlCL1FmWHdnCkdrZ3JtNmhN +UTFzaHYvMlpXbGxWWktjZ3g5TlpJQlNhN2JpVFF6Tjc5M1EKLT4gc3NoLWVkMjU1 +MTkgWkVyTFRnIGoxUHVNMEl2YWt2LzVVUCtZR2dPS2lKc3hGbGYzdy9DT1RTcVc1 +aXRZMjAKazlkcUZJT1lwbmdCVDY5OTZiVnpzWXVzdW9ZdnptYjBvUGk5MXo1dmNP +NAotPiAqNz0sXS1ncmVhc2UgSklHenpAJDMgUVIjPW4gNlRLe2QgYlM4KUkKT25y +NUJNRENXNWMKLS0tIGZhY0RXclQ2Y04yYXRpdlNzYlVOdkt6Mm9Nd3F2dWVIVWFE +S1AyVHlOSncKDAUyAaiOe9CBbSKZ3T7fo6uSoSLEAXBpYnuJgwZtR3bq6/L5aQwy +fZJpr7jwr6AblYx8LweS2Z0mIDWpDsaR8rjo+I14djnaXNuHECk= -----END AGE ENCRYPTED FILE----- diff --git a/hosts/ganymede/secrets/williams-psk.age b/hosts/ganymede/secrets/williams-psk.age index 1f26949..b7ba4f1 100644 --- a/hosts/ganymede/secrets/williams-psk.age +++ b/hosts/ganymede/secrets/williams-psk.age @@ -1,5 +1,12 @@ -age-encryption.org/v1 --> ssh-ed25519 Jg4yWQ x4yUAZMn9eCey8YxPpdecYM/gjL81nLx8knzQcZDlV0 -5me7Z8K2hvNyTNY80GUM+rB9trko2x1MyUHRmCXl9vA ---- sQ2n7Rc6fd4QqfibSvSJGvTCKXygTeas4rVBlUXreVE -|wBAB:B-=VD؄}Epnq \ No newline at end of file +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyBzb214 +a3c5eEF1cmpMcmxRYytnbnM2Y01DeTdPYW9rMjl4elBaYW5NWTFZCk9raEhIclhm +TE01a2JyVVZzTHpZeUF6ZW9kMFlZdmFNZkhXT0dTSkQ5a1kKLT4gc3NoLWVkMjU1 +MTkgWkVyTFRnIEVYblV0bGd6RWN4ei9kaDgzdlpCOGpyaGFoSzFTK1ZzQzRIdjdr +SXlnbTQKOHJJSHM5ck1PRENOUzBsZ0llZGJWd2lRNkoxL3ROQ1BqYVlVWnRDekpk +OAotPiBBQGg3XiItZ3JlYXNlIFZGWE1VZFtwClZieXlwdXg4Sy9raHNsYWZ4KzdU +T3FhTTA2L25zQTFNVnBoRVRPa2VWd1RHRHd5SjRRajdEVEpQVlAvTlF6ZFkKaENw +SAotLS0gL1E1VmFsdWNsMVdoNUxxaVdoSzdCblc4ZmZaSkhVd3NPU2JwZ3dlM3Ez +OAqc9LxEX2YGoyf8tdQJd1d+vF2lKyjOPVSGLY10L+wP61olt4MpicKDqutY+IUH +PjM= +-----END AGE ENCRYPTED FILE----- diff --git a/hosts/ganymede/wireguard.nix b/hosts/ganymede/wireguard.nix index 3c3f1d6..27d50bb 100644 --- a/hosts/ganymede/wireguard.nix +++ b/hosts/ganymede/wireguard.nix @@ -11,24 +11,10 @@ networking.firewall = { allowedUDPPorts = [51820]; - allowedTCPPorts = [51843]; trustedInterfaces = ["wg0"]; }; - systemd.services.udp2raw-server = { - description = "udp2raw WireGuard transport"; - wantedBy = ["multi-user.target"]; - after = ["network-online.target"]; - wants = ["network-online.target"]; - - serviceConfig = { - ExecStart = "${lib.getExe pkgs.udp2raw} -s -l 0.0.0.0:51843 -r 127.0.0.1:51820 -k shared-secret -a"; - Restart = "on-failure"; - RestartSec = "2s"; - }; - }; - systemd.network.netdevs."50-wg0" = { netdevConfig = { Kind = "wireguard"; -- cgit v1.3.1