summaryrefslogtreecommitdiff
path: root/os
diff options
context:
space:
mode:
Diffstat (limited to 'os')
-rw-r--r--os/cez/configuration.nix1
-rw-r--r--os/cez/modules/headscale.nix36
-rw-r--r--os/cez/modules/wireguard.nix68
-rw-r--r--os/cez/secrets.yaml5
-rw-r--r--os/kay/modules/network/default.nix1
-rw-r--r--os/kay/modules/network/headscale.nix15
-rw-r--r--os/kay/modules/network/wireguard.nix71
-rw-r--r--os/kay/modules/observability/prometheus.nix3
-rw-r--r--os/kay/secrets.yaml5
9 files changed, 50 insertions, 155 deletions
diff --git a/os/cez/configuration.nix b/os/cez/configuration.nix
index 2c5e59e..b97798a 100644
--- a/os/cez/configuration.nix
+++ b/os/cez/configuration.nix
@@ -3,7 +3,6 @@
../pc/configuration.nix
./hardware-configuration.nix
- ./modules/wireguard.nix
./modules/headscale.nix
./modules/tlp.nix
../../global/cez
diff --git a/os/cez/modules/headscale.nix b/os/cez/modules/headscale.nix
index fc465d8..169ed45 100644
--- a/os/cez/modules/headscale.nix
+++ b/os/cez/modules/headscale.nix
@@ -1,9 +1,38 @@
-{ config, ... }:
+{ config, pkgs, ... }:
let
headScaleUrl = "https://headscale.${config.global.userdata.domain}";
+ user = config.global.userdata.name;
+
+ exitNode = "kay";
+ helper = pkgs.writeShellApplication {
+ name = "vpn";
+ runtimeInputs = with pkgs; [
+ libnotify
+ tailscale
+ jq
+ ];
+
+ text = ''
+ note() {
+ command -v notify-send >/dev/null &&
+ notify-send "󰒒 Headscale" "$1"
+
+ printf "\n%s\n" "$1"
+ }
+
+ if [ "$(tailscale status --peers --json | jq ".ExitNodeStatus")" = "null" ]; then
+ tailscale set --exit-node=${exitNode} &&
+ note "Now routing all traffic through ${exitNode}"
+ else
+ tailscale set --exit-node= &&
+ note "Traffic now uses default route."
+ fi
+ '';
+ };
in
{
sops.secrets."misc/headscale" = { };
+ environment.systemPackages = [ helper ];
networking.firewall.trustedInterfaces = [ config.services.tailscale.interfaceName ];
services.tailscale = {
@@ -14,7 +43,10 @@ in
authKeyFile = config.sops.secrets."misc/headscale".path;
extraUpFlags = [
"--login-server=${headScaleUrl}"
- "--accept-routes"
+ ];
+ extraSetFlags = [
+ "--operator=${user}"
+ "--accept-routes=true"
];
};
}
diff --git a/os/cez/modules/wireguard.nix b/os/cez/modules/wireguard.nix
deleted file mode 100644
index 5e17293..0000000
--- a/os/cez/modules/wireguard.nix
+++ /dev/null
@@ -1,68 +0,0 @@
-{ config, pkgs, ... }:
-let
- domain = config.global.userdata.domain;
- wgIface = "kay";
-
- helper = pkgs.writeShellApplication {
- name = "vpn";
- text = ''
- note() {
- command -v notify-send > /dev/null &&
- notify-send "󰒒 VPN" "$1"
-
- printf "\n%s\n" "$1"
- }
-
- if systemctl status "wg-quick-${wgIface}.service" > /dev/null 2>&1; then
- sudo -A systemctl stop "wg-quick-${wgIface}.service" &&
- note "connection was dropped"
- else
- sudo -A systemctl start "wg-quick-${wgIface}.service" &&
- note "traffic routed through ${wgIface}"
- fi
- '';
- };
-in
-{
- sops.secrets."misc/wireguard" = { };
- environment.systemPackages = [ helper ];
-
- networking.wg-quick.interfaces = {
- ${wgIface} = {
- autostart = false;
- address = [ "10.0.1.2/24" ];
- dns = [ "10.0.1.1" ];
- mtu = 1412;
- privateKeyFile = config.sops.secrets."misc/wireguard".path;
-
- peers = [
- {
- publicKey = "wJMyQDXmZO4MjYRk6NK4+J6ZKWLTTZygAH+OwbPjOiw=";
- allowedIPs = [
- "10.0.1.0/24"
- "104.16.0.0/12"
- "172.64.0.0/13"
- ];
- endpoint = "${domain}:51820";
- persistentKeepalive = 25;
- }
- ];
- };
-
- bud = {
- autostart = true;
- address = [ "10.54.132.2/24" ];
- mtu = 1420;
- privateKeyFile = config.sops.secrets."misc/wireguard".path;
-
- peers = [
- {
- publicKey = "O2GRMEWf22YRGKexHAdg1fitucTZ/U/om2MWEJMeyFQ=";
- allowedIPs = [ "10.54.132.0/24" ];
- endpoint = "primary.k8s.bud.studio:51820";
- persistentKeepalive = 25;
- }
- ];
- };
- };
-}
diff --git a/os/cez/secrets.yaml b/os/cez/secrets.yaml
index 7b9923c..156e74d 100644
--- a/os/cez/secrets.yaml
+++ b/os/cez/secrets.yaml
@@ -1,5 +1,4 @@
misc:
- wireguard: ENC[AES256_GCM,data:WUHMeYro1PS25wEtsQKHHtpLXbtox8JtqX5863dHelBIA2SB7YZ+eWyv5hQ=,iv:hGgR3UcFeVGZjWJjdnVuQeUQtz3p4Lh6QRBJDfTr9Qo=,tag:4qpU9Ue4QtfBINdy0CSdvw==,type:str]
headscale: ENC[AES256_GCM,data:90xXwi0fPPdF929akAma85UmLkllCUmO1v0nWS8HxRw4gQq8fa9QKoYgGAt84bC6,iv:H0BZN7A21Hzs6p4wdP3ONVfvQyNchVSdc2GJ9BS+wyQ=,tag:fV9XpAOrVMQ5A2Dzo5BcyQ==,type:str]
sops:
age:
@@ -21,7 +20,7 @@ sops:
dVZ3V0VUQzF5VzN0RFM5c0RjZHpJZ0EK09qgyPHEhHgRZt2GZQB5IM9Z/nfYXW28
fcfmF6pko9qOYQ72P7vwv8Xub0SEI8GKGQwz2QPDJT9gd1qtipuhuQ==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-10-17T03:37:38Z"
- mac: ENC[AES256_GCM,data:hOs2aCnCs8yF2iLZawyI84olfFe86JTZ8KBgSFLpaE8Kd+HWsQyEa5M0yOMXCts/d0JqJFsMJqxmkcBxBSFT5cBVZM/gSh9TC7xbq14Ja3vRT6KcLZ3O4CI6pZvEvkuJALTSQSXIsxFZG3YoYsKdh67aqKr/uC3Jh5sASYxzIHg=,iv:F4d85Tk920eXa6mVKSBlmJ/dRHncZRiQGh3LHsJCLas=,tag:EO+1OERqvowVUGKe9a77oA==,type:str]
+ lastmodified: "2025-10-20T16:05:52Z"
+ mac: ENC[AES256_GCM,data:tsYOQDpWx23x7+N5LoRMuCQslqu6B+YgscSaSt0nnuuZxxYpiaalsE9znlQ8GCuAsDxUKJsbzRS0ek/vQVnt/tbwAQrlDK39/5LzErBpcnq8Mf4jF+CXU8XlvrC0EZ8Ut2nV5g4KZdax1sQ7Zl345PWwtD5hVL8nQeclanCdasc=,iv:MbYOeCBLbkZ9cOUhytmKou26DX1bIn7DFdX4p4+zROA=,tag:RaPHBe3ZyCluy1uzGjQacw==,type:str]
unencrypted_suffix: _unencrypted
version: 3.11.0
diff --git a/os/kay/modules/network/default.nix b/os/kay/modules/network/default.nix
index 56371c7..019ee24 100644
--- a/os/kay/modules/network/default.nix
+++ b/os/kay/modules/network/default.nix
@@ -12,7 +12,6 @@ in
imports = [
./router.nix
./hurricane.nix
- ./wireguard.nix
./headscale.nix
];
diff --git a/os/kay/modules/network/headscale.nix b/os/kay/modules/network/headscale.nix
index 14fcee3..39007a4 100644
--- a/os/kay/modules/network/headscale.nix
+++ b/os/kay/modules/network/headscale.nix
@@ -54,6 +54,11 @@ let
acls = [
{
action = "accept";
+ src = [ "*" ];
+ dst = [ "tag:namescale:${toString config.services.namescale.settings.port}" ];
+ }
+ {
+ action = "accept";
src = [ "headplane@" ];
dst = [ "*:*" ];
}
@@ -63,17 +68,21 @@ let
src = [ "group:owner" ];
dst = [ "*:*" ];
}
+ {
+ action = "accept";
+ src = [ "nazer@" ];
+ dst = [ "autogroup:internet:*" ];
+ }
{
action = "accept";
src = [ "group:bud" ];
dst = [ "tag:bud_clients:*" ];
}
-
{
action = "accept";
- src = [ "*" ];
- dst = [ "tag:namescale:${toString config.services.namescale.settings.port}" ];
+ src = [ "tag:bud_clients" ];
+ dst = [ "tag:bud_clients:80,443" ];
}
];
};
diff --git a/os/kay/modules/network/wireguard.nix b/os/kay/modules/network/wireguard.nix
deleted file mode 100644
index fd00804..0000000
--- a/os/kay/modules/network/wireguard.nix
+++ /dev/null
@@ -1,71 +0,0 @@
-{
- config,
- pkgs,
- lib,
- ...
-}:
-let
- wgInterface = "wg";
- wanInterface = "ppp0";
- port = 51820;
-
- wgConf = pkgs.writeText "wg.conf" ''
- [interface]
- Address = 10.0.1.1/24
- MTU = 1412
- ListenPort = 51820
- PostUp = ${
- lib.getExe (
- pkgs.writeShellApplication {
- name = "wg_set_key";
- runtimeInputs = with pkgs; [ wireguard-tools ];
- text = ''
- wg set ${wgInterface} private-key <(cat ${config.sops.secrets."misc/wireguard".path})
- '';
- }
- )
- }
-
- [Peer]
- # friendly_name = cez
- PublicKey = IcMpAs/D0u8O/AcDBPC7pFUYSeFQXQpTqHpGOeVpjS8=
- AllowedIPs = 10.0.1.2/32
-
- [Peer]
- # friendly_name = exy
- PublicKey = bJ9aqGYD2Jh4MtWIL7q3XxVHFuUdwGJwO8p7H3nNPj8=
- AllowedIPs = 10.0.1.3/32
-
- [Peer]
- # friendly_name = dad
- PublicKey = q70IyOS2IpubIRWqo5sL3SeEjtUy2V/PT8yqVExiHTQ=
- AllowedIPs = 10.0.1.4/32
- '';
-in
-{
- sops.secrets."misc/wireguard" = { };
-
- networking = {
- nat = {
- enable = true;
- externalInterface = wanInterface;
- internalInterfaces = [ wgInterface ];
- };
-
- firewall.allowedUDPPorts = [ port ];
- wg-quick.interfaces.${wgInterface}.configFile = builtins.toString wgConf;
- };
-
- services.dnsmasq.settings = {
- no-dhcp-interface = wgInterface;
- interface = [ wgInterface ];
- };
-
- services.prometheus.exporters.wireguard = {
- enable = true;
- withRemoteIp = true;
- wireguardConfig = builtins.toString wgConf;
- singleSubnetPerField = true;
- listenAddress = "127.0.0.1";
- };
-}
diff --git a/os/kay/modules/observability/prometheus.nix b/os/kay/modules/observability/prometheus.nix
index 1810f9e..9ca73da 100644
--- a/os/kay/modules/observability/prometheus.nix
+++ b/os/kay/modules/observability/prometheus.nix
@@ -13,9 +13,6 @@
targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ];
}
{
- targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.wireguard.port}" ];
- }
- {
targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.dnsmasq.port}" ];
}
{
diff --git a/os/kay/secrets.yaml b/os/kay/secrets.yaml
index e11bbd0..5f8c16d 100644
--- a/os/kay/secrets.yaml
+++ b/os/kay/secrets.yaml
@@ -25,7 +25,6 @@ headscale:
derp_private_key: ENC[AES256_GCM,data:EMt3RtQzqIY4i5S2S1kK0kxu0wMt3/bBcpaEc3YP0Cmj8F4yZECOaDUYk4dM2QsfmoP84plktAqIrM4MSiY94lQpqRoCvTru,iv:NU/nVFQxBQTou0mf5xvLmlda8hzJfoCRiU1vCgJGyyc=,tag:IEDCDy6ifL+ulYzp7qr3vg==,type:str]
pre_auth_key: ENC[AES256_GCM,data:ItKBknycoP9AcUN1OyTK/OQCUQzkpJfho5Rfm2o0u8g6WGo0F/awC07MQ4pL2lfM,iv:hfOj72ZUP4F28+0vuEXucMUzeL3FAx0rF2quyWTACYw=,tag:zGdtJakxXUOolvJMOCevvg==,type:str]
misc:
- wireguard: ENC[AES256_GCM,data:zwctPH+ScqRWUD4Jjcu/dTTGwxGl6rCEsp5D4+EfXPEIhECL2vjyTtcy5cM=,iv:yfv6fV5zxAbsVf+veTJYLmAwhJbaqFt89s3jlU+HO2k=,tag:vZldtANCKvMWW5pXRUv+vA==,type:str]
default_password: ENC[AES256_GCM,data:xON6jifcv8k8tKA=,iv:Kk3Ax/GGvCvAbTAhNnlkoNh1BzsrZVptchRuQi+vqhc=,tag:9vYn1Gslr+1pAYdKvwRhnA==,type:str]
nixbin.sinanmohd.com: ENC[AES256_GCM,data:iPYrZvEcg8WRl2iRnL5Z3Gxzpu1NWqgobdYuhFj3Ria/zZ+WL6LzSYMKtxxRaCbqXIacjIJKGpsZcesaJjcx6wmLR8EW8GRPPhHO9AjbZSLeBV2h6XwHbe6PD8y/Kjx2fBbIpDDTF2YwstvFqQ==,iv:AYv4Vnog+dlhKlZV8S3D/q7JiY2l2mVxLC/gWuI5MtA=,tag:dzZ8octvGcuuh9TXv0U88A==,type:str]
alina: ENC[AES256_GCM,data:KGSr5fLkngJvZRAGoTK0XfxJCgWQBJ8xd0oelU5j15yOooBctUQjQekmf9GiVnmZbU5OoxdraO6nUssZXEIfKKsCtCps+D2MkDDchL/+gbc+A3Q=,iv:LszKLO5CeultjHbSLUqz9Or9X5K7u9VCzuz9fBPFgmM=,tag:DONP4smkrTTsY0sJ8qyKIQ==,type:str]
@@ -49,7 +48,7 @@ sops:
bGRaOE1Mc3VqVnYyd0xIVGl5ckpqRFkKpT2gTC4lf9HRQNJDykdGjPdfH+V8og7X
XHq1XqIRoRbulZifuZlmzN/RWMPIoBYkXeHfqaMjmTz5HIBcnO/t9g==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-10-17T04:31:52Z"
- mac: ENC[AES256_GCM,data:0nN0kAbdMFNgzCa1ocn7EHDNV7SFH/9/P2EgwDQG37AyAxUJtZ5kxyobAPRAbApgtrlnDhCrdsV9ltGqk35TTiNK6qhx8gfdzK0MiMI0wYnhvoAyci1Hsg32Fv/vuZv1AWf1yAMaDMQXmzt0AiG9hJy9FdZO0oU8U2RbmFRMO3k=,iv:P4m/owrYllj+8R2Pm+iLAerbnmOCy3TzBgmGCxS65C4=,tag:mNEHL3kBMuFeSYfY6xnweQ==,type:str]
+ lastmodified: "2025-10-20T15:38:52Z"
+ mac: ENC[AES256_GCM,data:n0ShTAQ5ft5o38Y53MmSHzOyxEKwKT4TwELfj5kZ2rvZVI4o1jH+kcYnlYKcwPDCXNuIayFRVYRZ7KPEftPuTRgaKK74uCjYyrZh/hQP+pyFRg2va2Jkn5vymzsm2036DIPo2K2JkZtSlWgYG/BNuLVQZioghkKZ5pe23YyJqQs=,iv:NSQCmN081ZoGa2yfU8Bu0H2tfvWrOennYPWjtpRJ8G0=,tag:HDl78o8CmFviEqQWntvrQw==,type:str]
unencrypted_suffix: _unencrypted
version: 3.11.0