From 3107c3d5f435f551219f000b14538691908067e9 Mon Sep 17 00:00:00 2001 From: sinanmohd Date: Mon, 20 Oct 2025 21:30:24 +0530 Subject: chore(os): drop wireguard --- os/cez/configuration.nix | 1 - os/cez/modules/headscale.nix | 36 ++++++++++++++- os/cez/modules/wireguard.nix | 68 --------------------------- os/cez/secrets.yaml | 5 +- os/kay/modules/network/default.nix | 1 - os/kay/modules/network/wireguard.nix | 71 ----------------------------- os/kay/modules/observability/prometheus.nix | 3 -- os/kay/secrets.yaml | 5 +- 8 files changed, 38 insertions(+), 152 deletions(-) delete mode 100644 os/cez/modules/wireguard.nix delete mode 100644 os/kay/modules/network/wireguard.nix (limited to 'os') diff --git a/os/cez/configuration.nix b/os/cez/configuration.nix index 2c5e59e..b97798a 100644 --- a/os/cez/configuration.nix +++ b/os/cez/configuration.nix @@ -3,7 +3,6 @@ ../pc/configuration.nix ./hardware-configuration.nix - ./modules/wireguard.nix ./modules/headscale.nix ./modules/tlp.nix ../../global/cez diff --git a/os/cez/modules/headscale.nix b/os/cez/modules/headscale.nix index fc465d8..169ed45 100644 --- a/os/cez/modules/headscale.nix +++ b/os/cez/modules/headscale.nix @@ -1,9 +1,38 @@ -{ config, ... }: +{ config, pkgs, ... }: let headScaleUrl = "https://headscale.${config.global.userdata.domain}"; + user = config.global.userdata.name; + + exitNode = "kay"; + helper = pkgs.writeShellApplication { + name = "vpn"; + runtimeInputs = with pkgs; [ + libnotify + tailscale + jq + ]; + + text = '' + note() { + command -v notify-send >/dev/null && + notify-send "󰒒 Headscale" "$1" + + printf "\n%s\n" "$1" + } + + if [ "$(tailscale status --peers --json | jq ".ExitNodeStatus")" = "null" ]; then + tailscale set --exit-node=${exitNode} && + note "Now routing all traffic through ${exitNode}" + else + tailscale set --exit-node= && + note "Traffic now uses default route." + fi + ''; + }; in { sops.secrets."misc/headscale" = { }; + environment.systemPackages = [ helper ]; networking.firewall.trustedInterfaces = [ config.services.tailscale.interfaceName ]; services.tailscale = { @@ -14,7 +43,10 @@ in authKeyFile = config.sops.secrets."misc/headscale".path; extraUpFlags = [ "--login-server=${headScaleUrl}" - "--accept-routes" + ]; + extraSetFlags = [ + "--operator=${user}" + "--accept-routes=true" ]; }; } diff --git a/os/cez/modules/wireguard.nix b/os/cez/modules/wireguard.nix deleted file mode 100644 index 5e17293..0000000 --- a/os/cez/modules/wireguard.nix +++ /dev/null @@ -1,68 +0,0 @@ -{ config, pkgs, ... }: -let - domain = config.global.userdata.domain; - wgIface = "kay"; - - helper = pkgs.writeShellApplication { - name = "vpn"; - text = '' - note() { - command -v notify-send > /dev/null && - notify-send "󰒒 VPN" "$1" - - printf "\n%s\n" "$1" - } - - if systemctl status "wg-quick-${wgIface}.service" > /dev/null 2>&1; then - sudo -A systemctl stop "wg-quick-${wgIface}.service" && - note "connection was dropped" - else - sudo -A systemctl start "wg-quick-${wgIface}.service" && - note "traffic routed through ${wgIface}" - fi - ''; - }; -in -{ - sops.secrets."misc/wireguard" = { }; - environment.systemPackages = [ helper ]; - - networking.wg-quick.interfaces = { - ${wgIface} = { - autostart = false; - address = [ "10.0.1.2/24" ]; - dns = [ "10.0.1.1" ]; - mtu = 1412; - privateKeyFile = config.sops.secrets."misc/wireguard".path; - - peers = [ - { - publicKey = "wJMyQDXmZO4MjYRk6NK4+J6ZKWLTTZygAH+OwbPjOiw="; - allowedIPs = [ - "10.0.1.0/24" - "104.16.0.0/12" - "172.64.0.0/13" - ]; - endpoint = "${domain}:51820"; - persistentKeepalive = 25; - } - ]; - }; - - bud = { - autostart = true; - address = [ "10.54.132.2/24" ]; - mtu = 1420; - privateKeyFile = config.sops.secrets."misc/wireguard".path; - - peers = [ - { - publicKey = "O2GRMEWf22YRGKexHAdg1fitucTZ/U/om2MWEJMeyFQ="; - allowedIPs = [ "10.54.132.0/24" ]; - endpoint = "primary.k8s.bud.studio:51820"; - persistentKeepalive = 25; - } - ]; - }; - }; -} diff --git a/os/cez/secrets.yaml b/os/cez/secrets.yaml index 7b9923c..156e74d 100644 --- a/os/cez/secrets.yaml +++ b/os/cez/secrets.yaml @@ -1,5 +1,4 @@ misc: - wireguard: ENC[AES256_GCM,data:WUHMeYro1PS25wEtsQKHHtpLXbtox8JtqX5863dHelBIA2SB7YZ+eWyv5hQ=,iv:hGgR3UcFeVGZjWJjdnVuQeUQtz3p4Lh6QRBJDfTr9Qo=,tag:4qpU9Ue4QtfBINdy0CSdvw==,type:str] headscale: ENC[AES256_GCM,data:90xXwi0fPPdF929akAma85UmLkllCUmO1v0nWS8HxRw4gQq8fa9QKoYgGAt84bC6,iv:H0BZN7A21Hzs6p4wdP3ONVfvQyNchVSdc2GJ9BS+wyQ=,tag:fV9XpAOrVMQ5A2Dzo5BcyQ==,type:str] sops: age: @@ -21,7 +20,7 @@ sops: dVZ3V0VUQzF5VzN0RFM5c0RjZHpJZ0EK09qgyPHEhHgRZt2GZQB5IM9Z/nfYXW28 fcfmF6pko9qOYQ72P7vwv8Xub0SEI8GKGQwz2QPDJT9gd1qtipuhuQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-10-17T03:37:38Z" - mac: ENC[AES256_GCM,data:hOs2aCnCs8yF2iLZawyI84olfFe86JTZ8KBgSFLpaE8Kd+HWsQyEa5M0yOMXCts/d0JqJFsMJqxmkcBxBSFT5cBVZM/gSh9TC7xbq14Ja3vRT6KcLZ3O4CI6pZvEvkuJALTSQSXIsxFZG3YoYsKdh67aqKr/uC3Jh5sASYxzIHg=,iv:F4d85Tk920eXa6mVKSBlmJ/dRHncZRiQGh3LHsJCLas=,tag:EO+1OERqvowVUGKe9a77oA==,type:str] + lastmodified: "2025-10-20T16:05:52Z" + mac: ENC[AES256_GCM,data:tsYOQDpWx23x7+N5LoRMuCQslqu6B+YgscSaSt0nnuuZxxYpiaalsE9znlQ8GCuAsDxUKJsbzRS0ek/vQVnt/tbwAQrlDK39/5LzErBpcnq8Mf4jF+CXU8XlvrC0EZ8Ut2nV5g4KZdax1sQ7Zl345PWwtD5hVL8nQeclanCdasc=,iv:MbYOeCBLbkZ9cOUhytmKou26DX1bIn7DFdX4p4+zROA=,tag:RaPHBe3ZyCluy1uzGjQacw==,type:str] unencrypted_suffix: _unencrypted version: 3.11.0 diff --git a/os/kay/modules/network/default.nix b/os/kay/modules/network/default.nix index 56371c7..019ee24 100644 --- a/os/kay/modules/network/default.nix +++ b/os/kay/modules/network/default.nix @@ -12,7 +12,6 @@ in imports = [ ./router.nix ./hurricane.nix - ./wireguard.nix ./headscale.nix ]; diff --git a/os/kay/modules/network/wireguard.nix b/os/kay/modules/network/wireguard.nix deleted file mode 100644 index fd00804..0000000 --- a/os/kay/modules/network/wireguard.nix +++ /dev/null @@ -1,71 +0,0 @@ -{ - config, - pkgs, - lib, - ... -}: -let - wgInterface = "wg"; - wanInterface = "ppp0"; - port = 51820; - - wgConf = pkgs.writeText "wg.conf" '' - [interface] - Address = 10.0.1.1/24 - MTU = 1412 - ListenPort = 51820 - PostUp = ${ - lib.getExe ( - pkgs.writeShellApplication { - name = "wg_set_key"; - runtimeInputs = with pkgs; [ wireguard-tools ]; - text = '' - wg set ${wgInterface} private-key <(cat ${config.sops.secrets."misc/wireguard".path}) - ''; - } - ) - } - - [Peer] - # friendly_name = cez - PublicKey = IcMpAs/D0u8O/AcDBPC7pFUYSeFQXQpTqHpGOeVpjS8= - AllowedIPs = 10.0.1.2/32 - - [Peer] - # friendly_name = exy - PublicKey = bJ9aqGYD2Jh4MtWIL7q3XxVHFuUdwGJwO8p7H3nNPj8= - AllowedIPs = 10.0.1.3/32 - - [Peer] - # friendly_name = dad - PublicKey = q70IyOS2IpubIRWqo5sL3SeEjtUy2V/PT8yqVExiHTQ= - AllowedIPs = 10.0.1.4/32 - ''; -in -{ - sops.secrets."misc/wireguard" = { }; - - networking = { - nat = { - enable = true; - externalInterface = wanInterface; - internalInterfaces = [ wgInterface ]; - }; - - firewall.allowedUDPPorts = [ port ]; - wg-quick.interfaces.${wgInterface}.configFile = builtins.toString wgConf; - }; - - services.dnsmasq.settings = { - no-dhcp-interface = wgInterface; - interface = [ wgInterface ]; - }; - - services.prometheus.exporters.wireguard = { - enable = true; - withRemoteIp = true; - wireguardConfig = builtins.toString wgConf; - singleSubnetPerField = true; - listenAddress = "127.0.0.1"; - }; -} diff --git a/os/kay/modules/observability/prometheus.nix b/os/kay/modules/observability/prometheus.nix index 1810f9e..9ca73da 100644 --- a/os/kay/modules/observability/prometheus.nix +++ b/os/kay/modules/observability/prometheus.nix @@ -12,9 +12,6 @@ { targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.node.port}" ]; } - { - targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.wireguard.port}" ]; - } { targets = [ "127.0.0.1:${toString config.services.prometheus.exporters.dnsmasq.port}" ]; } diff --git a/os/kay/secrets.yaml b/os/kay/secrets.yaml index e11bbd0..5f8c16d 100644 --- a/os/kay/secrets.yaml +++ b/os/kay/secrets.yaml @@ -25,7 +25,6 @@ headscale: derp_private_key: ENC[AES256_GCM,data:EMt3RtQzqIY4i5S2S1kK0kxu0wMt3/bBcpaEc3YP0Cmj8F4yZECOaDUYk4dM2QsfmoP84plktAqIrM4MSiY94lQpqRoCvTru,iv:NU/nVFQxBQTou0mf5xvLmlda8hzJfoCRiU1vCgJGyyc=,tag:IEDCDy6ifL+ulYzp7qr3vg==,type:str] pre_auth_key: ENC[AES256_GCM,data:ItKBknycoP9AcUN1OyTK/OQCUQzkpJfho5Rfm2o0u8g6WGo0F/awC07MQ4pL2lfM,iv:hfOj72ZUP4F28+0vuEXucMUzeL3FAx0rF2quyWTACYw=,tag:zGdtJakxXUOolvJMOCevvg==,type:str] misc: - wireguard: ENC[AES256_GCM,data:zwctPH+ScqRWUD4Jjcu/dTTGwxGl6rCEsp5D4+EfXPEIhECL2vjyTtcy5cM=,iv:yfv6fV5zxAbsVf+veTJYLmAwhJbaqFt89s3jlU+HO2k=,tag:vZldtANCKvMWW5pXRUv+vA==,type:str] default_password: ENC[AES256_GCM,data:xON6jifcv8k8tKA=,iv:Kk3Ax/GGvCvAbTAhNnlkoNh1BzsrZVptchRuQi+vqhc=,tag:9vYn1Gslr+1pAYdKvwRhnA==,type:str] nixbin.sinanmohd.com: ENC[AES256_GCM,data:iPYrZvEcg8WRl2iRnL5Z3Gxzpu1NWqgobdYuhFj3Ria/zZ+WL6LzSYMKtxxRaCbqXIacjIJKGpsZcesaJjcx6wmLR8EW8GRPPhHO9AjbZSLeBV2h6XwHbe6PD8y/Kjx2fBbIpDDTF2YwstvFqQ==,iv:AYv4Vnog+dlhKlZV8S3D/q7JiY2l2mVxLC/gWuI5MtA=,tag:dzZ8octvGcuuh9TXv0U88A==,type:str] alina: ENC[AES256_GCM,data:KGSr5fLkngJvZRAGoTK0XfxJCgWQBJ8xd0oelU5j15yOooBctUQjQekmf9GiVnmZbU5OoxdraO6nUssZXEIfKKsCtCps+D2MkDDchL/+gbc+A3Q=,iv:LszKLO5CeultjHbSLUqz9Or9X5K7u9VCzuz9fBPFgmM=,tag:DONP4smkrTTsY0sJ8qyKIQ==,type:str] @@ -49,7 +48,7 @@ sops: bGRaOE1Mc3VqVnYyd0xIVGl5ckpqRFkKpT2gTC4lf9HRQNJDykdGjPdfH+V8og7X XHq1XqIRoRbulZifuZlmzN/RWMPIoBYkXeHfqaMjmTz5HIBcnO/t9g== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-10-17T04:31:52Z" - mac: ENC[AES256_GCM,data:0nN0kAbdMFNgzCa1ocn7EHDNV7SFH/9/P2EgwDQG37AyAxUJtZ5kxyobAPRAbApgtrlnDhCrdsV9ltGqk35TTiNK6qhx8gfdzK0MiMI0wYnhvoAyci1Hsg32Fv/vuZv1AWf1yAMaDMQXmzt0AiG9hJy9FdZO0oU8U2RbmFRMO3k=,iv:P4m/owrYllj+8R2Pm+iLAerbnmOCy3TzBgmGCxS65C4=,tag:mNEHL3kBMuFeSYfY6xnweQ==,type:str] + lastmodified: "2025-10-20T15:38:52Z" + mac: ENC[AES256_GCM,data:n0ShTAQ5ft5o38Y53MmSHzOyxEKwKT4TwELfj5kZ2rvZVI4o1jH+kcYnlYKcwPDCXNuIayFRVYRZ7KPEftPuTRgaKK74uCjYyrZh/hQP+pyFRg2va2Jkn5vymzsm2036DIPo2K2JkZtSlWgYG/BNuLVQZioghkKZ5pe23YyJqQs=,iv:NSQCmN081ZoGa2yfU8Bu0H2tfvWrOennYPWjtpRJ8G0=,tag:HDl78o8CmFviEqQWntvrQw==,type:str] unencrypted_suffix: _unencrypted version: 3.11.0 -- cgit v1.2.3