diff options
| author | vin <git@vineetk.net> | 2026-04-22 12:40:27 -0400 |
|---|---|---|
| committer | vin <git@vineetk.net> | 2026-04-22 12:40:27 -0400 |
| commit | 68fdb8577359fcc139785806d5f843bf05e09285 (patch) | |
| tree | 7e5f7ce78731c7b0089d594f1acd1559e512b183 | |
| parent | e44fd7af97ed0284dca634add18af187a7865693 (diff) | |
hastur: fix wireguard interfaces not starting on boot
| -rw-r--r-- | epistemia/systems/hastur.scm | 80 |
1 files changed, 41 insertions, 39 deletions
diff --git a/epistemia/systems/hastur.scm b/epistemia/systems/hastur.scm index 839821d..b63e0b4 100644 --- a/epistemia/systems/hastur.scm +++ b/epistemia/systems/hastur.scm | |||
| @@ -167,47 +167,49 @@ | |||
| 167 | ("root" ,(local-file "/data/ssh/id_ed25519.pub")))))) | 167 | ("root" ,(local-file "/data/ssh/id_ed25519.pub")))))) |
| 168 | (service wireguard-service-type | 168 | (service wireguard-service-type |
| 169 | (wireguard-configuration | 169 | (wireguard-configuration |
| 170 | (interface "wg0") | 170 | (interface "wg0") |
| 171 | (addresses '("10.179.194.21/32" "fd7d:76ee:e68f:a993:cee4:5b6c:bce1:9350/128")) | 171 | (addresses '("10.179.194.21/32" "fd7d:76ee:e68f:a993:cee4:5b6c:bce1:9350/128")) |
| 172 | (port 51821) | 172 | (port 51821) |
| 173 | (bootstrap-private-key? #f) | 173 | (bootstrap-private-key? #f) |
| 174 | (shepherd-requirement '(age-secret networking)) | 174 | (shepherd-requirement '(age-secret wpa-supplicant)) |
| 175 | (private-key "/run/secrets/wg0_hastur") | 175 | (private-key "/run/secrets/wg0_hastur") |
| 176 | (pre-up '("while [ ! -f /run/secrets/wg0_hastur ]; do sleep 1; done" | 176 | (pre-up '("while [ ! -f /run/secrets/wg0_hastur ]; do sleep 1; done" |
| 177 | "ip route add 184.75.221.173 via $(ip route show default | cut -d' ' -f3) dev wlan0")) | 177 | "while [ -z \"$(ip route show default)\" ]; do sleep 1; done" |
| 178 | (post-down '("ip route del 184.75.221.173")) | 178 | "ip route add 184.75.221.173 via $(ip route show default | cut -d' ' -f3) dev wlan0")) |
| 179 | (peers | 179 | (post-down '("ip route del 184.75.221.173")) |
| 180 | (list | 180 | (peers |
| 181 | (wireguard-peer | 181 | (list |
| 182 | (name "airvpn-canada") | 182 | (wireguard-peer |
| 183 | (public-key "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=") | 183 | (name "airvpn-canada") |
| 184 | (preshared-key "/run/secrets/wg0psk_hastur") | 184 | (public-key "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=") |
| 185 | (allowed-ips '("0.0.0.0/0" "::0/0")) | 185 | (preshared-key "/run/secrets/wg0psk_hastur") |
| 186 | (endpoint "184.75.221.173:1637")))))) | 186 | (allowed-ips '("0.0.0.0/0" "::0/0")) |
| 187 | (endpoint "184.75.221.173:1637")))))) | ||
| 187 | (service wireguard-service-type | 188 | (service wireguard-service-type |
| 188 | (wireguard-configuration | 189 | (wireguard-configuration |
| 189 | (interface "wg1") | 190 | (interface "wg1") |
| 190 | (addresses '("10.0.13.3/24" "fd00:b0ba:cafe:babe::3/64 ")) | 191 | (addresses '("10.0.13.3/24" "fd00:b0ba:cafe:babe::3/64 ")) |
| 191 | (port 51820) | 192 | (port 51820) |
| 192 | (bootstrap-private-key? #f) | 193 | (bootstrap-private-key? #f) |
| 193 | (private-key "/run/secrets/wg1_hastur") | 194 | (private-key "/run/secrets/wg1_hastur") |
| 194 | (table #f) | 195 | (table #f) |
| 195 | (shepherd-requirement '(age-secret networking unbound)) | 196 | (shepherd-requirement '(age-secret unbound wpa-supplicant)) |
| 196 | (pre-up '("while [ ! -f /run/secrets/wg1_hastur ]; do sleep 1; done")) | 197 | (pre-up '("while [ ! -f /run/secrets/wg1_hastur ]; do sleep 1; done" |
| 197 | (peers | 198 | "while [ -z \"$(ip route show default)\" ]; do sleep 1; done")) |
| 198 | (list | 199 | (peers |
| 199 | (wireguard-peer | 200 | (list |
| 200 | (name "saklas.epistemia") | 201 | (wireguard-peer |
| 201 | (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=") | 202 | (name "saklas.epistemia") |
| 202 | (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128")) | 203 | (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=") |
| 203 | (endpoint "162.55.242.220:51820") | 204 | (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128")) |
| 204 | (keep-alive 25)) | 205 | (endpoint "162.55.242.220:51820") |
| 205 | (wireguard-peer | 206 | (keep-alive 25)) |
| 206 | (name "demiurge.epistemia") | 207 | (wireguard-peer |
| 207 | (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=") | 208 | (name "demiurge.epistemia") |
| 208 | (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128")) | 209 | (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=") |
| 209 | (endpoint "carcosa.13f0.net:51820") | 210 | (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128")) |
| 210 | (keep-alive 25)))))) | 211 | (endpoint "carcosa.13f0.net:51820") |
| 212 | (keep-alive 25)))))) | ||
| 211 | (service pam-limits-service-type | 213 | (service pam-limits-service-type |
| 212 | (list (pam-limits-entry "@audio" 'both 'rtprio 99) | 214 | (list (pam-limits-entry "@audio" 'both 'rtprio 99) |
| 213 | (pam-limits-entry "@audio" 'both 'memlock 'unlimited))) | 215 | (pam-limits-entry "@audio" 'both 'memlock 'unlimited))) |