chore(os/kay): refactor sops

2 files changed, 160 insertions, 0 deletions

diff --git a/os/kay/modules/network/hurricane/default.nix b/os/kay/modules/network/hurricane/default.nix
new file mode 100644
index 0000000..63be43e
--- /dev/null
+++ b/os/kay/modules/network/hurricane/default.nix
@@ -0,0 +1,132 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  iface = "hurricane";
+  remote = "216.218.221.42";
+
+  clinet = "2001:470:35:72a::2";
+  server = "2001:470:35:72a::1";
+
+  prefix64 = "2001:470:36:72a::/64";
+  prefix48 = "2001:470:ee65::/48";
+
+  makeAddr =
+    prefix: host:
+    let
+      split = lib.strings.splitString "/" prefix;
+    in
+    {
+      address = "${lib.head split}${host}";
+      prefixLength = lib.toInt (lib.last split);
+    };
+in
+{
+  networking = {
+    sits.${iface} = {
+      inherit remote;
+      ttl = 225;
+    };
+    interfaces.${iface} = {
+      mtu = 1472; # 1492(ppp0) - 20
+      ipv6.addresses = [
+        {
+          address = clinet;
+          prefixLength = 64;
+        }
+
+        (makeAddr prefix64 "1")
+        (makeAddr prefix48 "1")
+        (makeAddr prefix48 "1337")
+      ];
+    };
+
+    iproute2 = {
+      enable = true;
+      rttablesExtraConfig = "200 hurricane";
+    };
+
+    firewall = {
+      extraCommands = "iptables -A INPUT --proto 41 --source ${remote} --jump ACCEPT";
+      extraStopCommands = "iptables -D INPUT --proto 41 --source ${remote} --jump ACCEPT";
+    };
+  };
+
+  sops.secrets = {
+    "hurricane/username".sopsFile = ./secrets.yaml;
+    "hurricane/update_key".sopsFile = ./secrets.yaml;
+    "hurricane/tunnel_id".sopsFile = ./secrets.yaml;
+  };
+
+  systemd.services."network-route-${iface}" = {
+    description = "Routing configuration of ${iface}";
+    wantedBy = [
+      "network-setup.service"
+      "network.target"
+    ];
+    before = [ "network-setup.service" ];
+    bindsTo = [ "network-addresses-hurricane.service" ];
+    after = [
+      "network-pre.target"
+      "network-addresses-hurricane.service"
+    ];
+    # restart rather than stop+start this unit to prevent the
+    # network from dying during switch-to-configuration.
+    stopIfChanged = false;
+
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+
+    path = [ pkgs.iproute2 ];
+    script = ''
+      echo -n "adding route"
+
+      ip -6 rule add from ${clinet}/64 table hurricane || exit 1
+      ip -6 rule add from ${prefix64} table hurricane || exit 1
+      ip -6 rule add from ${prefix48} table hurricane || exit 1
+
+      ip -6 route add default via ${server} dev hurricane table hurricane || exit 1
+    '';
+    preStop = ''
+      echo -n "deleting route"
+
+      ip -6 route del default via ${server} dev hurricane table hurricane || exit 1
+
+      ip -6 rule del from ${prefix48} table hurricane || exit 1
+      ip -6 rule del from ${prefix64} table hurricane || exit 1
+      ip -6 rule del from ${clinet}/64 table hurricane || exit 1
+    '';
+  };
+
+  services.pppd.script."01-${iface}" = {
+    runtimeInputs = with pkgs; [
+      curl
+      coreutils
+      iproute2
+      iputils
+    ];
+    text = ''
+      wan_ip="$4"
+      username="$(cat ${config.sops.secrets."hurricane/username".path})"
+      update_key="$(cat ${config.sops.secrets."hurricane/update_key".path})"
+      tunnel_id="$(cat ${config.sops.secrets."hurricane/tunnel_id".path})"
+
+      auth_url="https://$username:$update_key@ipv4.tunnelbroker.net/nic/update?hostname=$tunnel_id"
+      until curl --silent "$auth_url"; do
+          sleep 1
+      done
+
+      while [ ! -e /sys/class/net/${iface} ]; do
+          sleep 1 # make sure ${iface} is up
+      done
+
+      ip tunnel change ${iface} local "$wan_ip" mode sit
+    '';
+  };
+}
diff --git a/os/kay/modules/network/hurricane/secrets.yaml b/os/kay/modules/network/hurricane/secrets.yaml
new file mode 100644
index 0000000..bbb0b57
--- /dev/null
+++ b/os/kay/modules/network/hurricane/secrets.yaml
@@ -0,0 +1,28 @@
+hurricane:
+    username: ENC[AES256_GCM,data:qPZB7icdzaYt,iv:EeucYLIWUOTKeWsnbzc5KrNwXj3EGAECoz5wdPrfMiY=,tag:65zQIFgUL8jNejzIGN56zQ==,type:str]
+    update_key: ENC[AES256_GCM,data:q9tzqMMT9nI69KeC9utyiRQuzPuPnwwn4pEU01QF074m+J+FP53RDQ==,iv:8ZZ0Nc/8fIQYxC51Fsz5NwEXytgMYvLoqS2uqLDP5sw=,tag:QyKcz9IgOjcvSiEP8HrROQ==,type:str]
+    tunnel_id: ENC[AES256_GCM,data:at2gf+GP,iv:ilIJ+MUXUugRGZMJjHIs/E7nt/daDBxjmCODcldkCC8=,tag:qB3xE6WP4O4aQgyb+jO5SQ==,type:str]
+sops:
+    age:
+        - recipient: age1q5sfy74d53n6jxlgsc2zrsz4wcl9d830nxuagc3wfmdkrrp55ckq9ev6nv
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1M250TTZNT0U5TE14T1Ar
+            OGF3MzZKanFWeVJ6NDVyR0ptNWdqVmFQUDMwCmhESnVwTlpSaEJSRDg4dUo3d0Jp
+            M2ZzZmlYZ3BCcWpHcXYwU1NZbXFsejAKLS0tIDd3ZkdmRTczN3V1ZFN0VXhOM0hz
+            NC9IWU80RkdrTUFGTWhjOXpwTTdzK3cKX6P58b/Zf81CkQopzQgXEH38BVJ8dm3c
+            T3il1Di+oV4da29QOdgQPLthpoa8c/6Mfw70XC1pCqJViTYGQSV/ww==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age15989j5lkkf2kn5wa2p6qc8wlxjjksc63k5ync8rz8t4e87394pzqm7h4rm
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFd3dDTmFiRjkwSTNlY2lQ
+            bWpMTHpCNFhVei9EcUR1RkxteUtXdzRsMUUwCjNqYW5UdTFXdzFWMW1HL1pZL2pz
+            Q2lIbktpUGtVSStoekdrQUJkcDZGSFkKLS0tIFIwZUo1SDd5UUxvaHU5aDg2alFO
+            K1ZsMGtjb0ZJUzdRNllxc3lxRVpPb2MK7jYH9Vd/BQW6M2w4gpZ/7/Fvup2enPct
+            z8b9coCmFfYkQMOopar5Qq+1Tf+sXmt+e9T4XWdRTGer3si8/X+jmA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-27T03:19:40Z"
+    mac: ENC[AES256_GCM,data:kHw69RgfHhmMzaIUoPL0DziPOmY+7dBXWVzLO2Yo8fun7egtqPLqjmDT11BSvGO7SBBBJkzTUjoV/8kQuui2mEaNZ9Pu6yaLEuGoWU/yN8rwGyEAvMW/jsyRKI/featE1kUgmWrTrRdHw/oXCDUEABRGk51v67NwQef0nlGhjM8=,iv:GWRU/avtXRSJ3tjgt4tKH5A6srOp/N7jV0kZAC/GX8Q=,tag:2k/1UwWj56mUXMVQBBM5ng==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0