summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorvin <git@vineetk.net>2026-04-28 15:46:27 -0400
committervin <git@vineetk.net>2026-04-28 15:46:50 -0400
commitbe281ea8291bd94acf31883b5a84d12b6a89066b (patch)
treeb21789d7e9ad2d2eb939658b7001efaf4c5748c0
parentd6ea4ce49907527a7f0981426b640e7b73bbd7b8 (diff)
hastur: add wg2 vpn for tailscale bridge
Diffstat
-rw-r--r--epistemia/secrets/email_13f0.age14
-rw-r--r--epistemia/secrets/email_vinbiz.agebin383 -> 383 bytes
-rw-r--r--epistemia/secrets/email_vineetk.age13
-rwxr-xr-xepistemia/secrets/rekey.scm1
-rw-r--r--epistemia/secrets/saklas_smtpd_dkim.agebin1997 -> 1997 bytes
-rw-r--r--epistemia/secrets/saklas_smtpd_passwd.agebin861 -> 861 bytes
-rw-r--r--epistemia/secrets/saklas_smtpd_virtuals.agebin778 -> 778 bytes
-rw-r--r--epistemia/secrets/wg0_demiurge.agebin367 -> 367 bytes
-rw-r--r--epistemia/secrets/wg0_hastur.agebin367 -> 367 bytes
-rw-r--r--epistemia/secrets/wg0psk_demiurge.age13
-rw-r--r--epistemia/secrets/wg0psk_hastur.agebin367 -> 367 bytes
-rw-r--r--epistemia/secrets/wg1_demiurge.age12
-rw-r--r--epistemia/secrets/wg1_hastur.agebin367 -> 367 bytes
-rw-r--r--epistemia/secrets/wg1_saklas.agebin367 -> 367 bytes
-rw-r--r--epistemia/secrets/wg2_hastur.agebin0 -> 367 bytes
-rw-r--r--epistemia/secrets/wpa_supplicant.agebin917 -> 917 bytes
-rw-r--r--epistemia/systems/hastur.scm25
17 files changed, 49 insertions, 29 deletions
diff --git a/epistemia/secrets/email_13f0.age b/epistemia/secrets/email_13f0.age
index 3735767..5765c83 100644
--- a/epistemia/secrets/email_13f0.age
+++ b/epistemia/secrets/email_13f0.age
@@ -1,9 +1,7 @@
1age-encryption.org/v1 1age-encryption.org/v1
2-> ssh-ed25519 KXd7pg JA+X0qP4lZHscj7Ab0H6WnsCxy9gEkgonP6H6WtF1BI 2-> ssh-ed25519 KXd7pg 3ynY12E0LLLdLSRgCzO09VphQeBJNdIQmkI2o2TWQR8
3p4wWKg1f5EcKarC2TVOkhZCL5W6DPnGn992CYErST/g 3j6mTyDW0Q5bztnwpWx3+pp/yBEbHDq6xk+hLcLuUYSM
4-> ssh-ed25519 AaF/mQ UfWdAg/v4ZHheetWWhowrRycjhtmVDA33coPteQxgFg 4-> ssh-ed25519 AaF/mQ bW5AHW9v+qR90tl33Vi18bnHw6CpcEORHZHwtFPeths
5V9AjDexq0Fn9TDX55d2IEEIB9KvHcjIUW6K1VxNseMg 5wwAoH2Tq6xZacVb6Z6f1/NkceNj9cnXDUPzxfVd/Bww
6--- npGLxhYw6SHfQMaRQpbPAicNuGpBIuRZruDLfLSurPQ 6--- 6ELNb4Arc/FnxV92/H6byhQbS4+4tpLvYepUWknrN8c
7[LeAKv9?Z ׹;& 9f^)h3ҡs[A,+M'w> 7*wЮT8jY"DVcdRuA"wڨ1v?XGZ>>(StjTzqw>APkx/L \ No newline at end of file
8]{L>Jz
9$5Gb;V \ No newline at end of file
diff --git a/epistemia/secrets/email_vinbiz.age b/epistemia/secrets/email_vinbiz.age
index 9217199..2fef9d6 100644
--- a/epistemia/secrets/email_vinbiz.age
+++ b/epistemia/secrets/email_vinbiz.age
Binary files differ
diff --git a/epistemia/secrets/email_vineetk.age b/epistemia/secrets/email_vineetk.age
index 53bee45..4aff283 100644
--- a/epistemia/secrets/email_vineetk.age
+++ b/epistemia/secrets/email_vineetk.age
@@ -1,7 +1,8 @@
1age-encryption.org/v1 1age-encryption.org/v1
2-> ssh-ed25519 KXd7pg MJmX/dmIv7JQ+snLvnhmAgiw6T1EkjCoYKmXiBBOwlo 2-> ssh-ed25519 KXd7pg ojjTKqcrvwYGyWUP+NHl3x6ypIMx/PFS7b2sczUyxEI
3cj3y6LLsFWiG5ExZAi8bNcIjSiBTZgEt8JpTTVBB9Xc 3uq2/4eOfidjq+Fj0lefjSWuPzotmYR1A48/BiC+qQgI
4-> ssh-ed25519 AaF/mQ LLgXnyqiGnTTGKD6e1bwu/YULJq5qEXfzqAG8Z/awV4 4-> ssh-ed25519 AaF/mQ AyHpcN5Wsz2kh9U4ENTm+YtQoiScsAMikePd62LiGWw
5s/660BRmbahOXMR8VVCyRXY0kYTWXRGVcy7K+MZRoTk 5PYORjQ9akT1Kcq0Onx6zPm0A6p4wxPNuazHdf4LCdWU
6--- BDSl2ZiQKBMeGHGlQ+gIksrGYFph/jIA1T86qjwZYUQ 6--- Sv54CL3Cf9+1UlEs08tDS5SVcBqh3Q9Me30uaU5QSyE
71g0 bV@{!_v\_k``RYCo߫6_p?y~ׇZ$쓪(t $&[ ΦY5< \ No newline at end of file 77 B IZfVw=[
8;wPGqfNN%zݝoorܥuw~^87 \ No newline at end of file
diff --git a/epistemia/secrets/rekey.scm b/epistemia/secrets/rekey.scm
index 5a7f051..36b0063 100755
--- a/epistemia/secrets/rekey.scm
+++ b/epistemia/secrets/rekey.scm
@@ -27,6 +27,7 @@
27 ("wg0_hastur" . ,hastur) 27 ("wg0_hastur" . ,hastur)
28 ("wg0psk_hastur" . ,hastur) 28 ("wg0psk_hastur" . ,hastur)
29 ("wg1_hastur" . ,hastur) 29 ("wg1_hastur" . ,hastur)
30 ("wg2_hastur" . ,hastur)
30 ("wpa_supplicant" . ,hastur))) 31 ("wpa_supplicant" . ,hastur)))
31 32
32(define (run fmt . args) 33(define (run fmt . args)
diff --git a/epistemia/secrets/saklas_smtpd_dkim.age b/epistemia/secrets/saklas_smtpd_dkim.age
index 351e0a5..a5e1417 100644
--- a/epistemia/secrets/saklas_smtpd_dkim.age
+++ b/epistemia/secrets/saklas_smtpd_dkim.age
Binary files differ
diff --git a/epistemia/secrets/saklas_smtpd_passwd.age b/epistemia/secrets/saklas_smtpd_passwd.age
index d93d80e..b6a4c51 100644
--- a/epistemia/secrets/saklas_smtpd_passwd.age
+++ b/epistemia/secrets/saklas_smtpd_passwd.age
Binary files differ
diff --git a/epistemia/secrets/saklas_smtpd_virtuals.age b/epistemia/secrets/saklas_smtpd_virtuals.age
index fab8aef..8cef3ac 100644
--- a/epistemia/secrets/saklas_smtpd_virtuals.age
+++ b/epistemia/secrets/saklas_smtpd_virtuals.age
Binary files differ
diff --git a/epistemia/secrets/wg0_demiurge.age b/epistemia/secrets/wg0_demiurge.age
index 8838c7d..5b930b8 100644
--- a/epistemia/secrets/wg0_demiurge.age
+++ b/epistemia/secrets/wg0_demiurge.age
Binary files differ
diff --git a/epistemia/secrets/wg0_hastur.age b/epistemia/secrets/wg0_hastur.age
index 92822fa..4106089 100644
--- a/epistemia/secrets/wg0_hastur.age
+++ b/epistemia/secrets/wg0_hastur.age
Binary files differ
diff --git a/epistemia/secrets/wg0psk_demiurge.age b/epistemia/secrets/wg0psk_demiurge.age
index d27971c..260a12d 100644
--- a/epistemia/secrets/wg0psk_demiurge.age
+++ b/epistemia/secrets/wg0psk_demiurge.age
@@ -1,8 +1,7 @@
1age-encryption.org/v1 1age-encryption.org/v1
2-> ssh-ed25519 947m3A Dh919UZSR7b8AjtEjXM6KeZTIDSGQWYCef+8IiTk+yg 2-> ssh-ed25519 947m3A UgHVFVeQDm9j/FIlqCp8PcQ2/yeArslKFhdldFoL+Rk
3Bwu8OFPT/sYl5IBW2OB6yR6PE9gbZtKijJRdVCpvFSg 3JUvVep6kqYNPQAd0SqjeE4CNzjOqlHw+q+ZSrR7riUk
4-> ssh-ed25519 AaF/mQ E2hpAaLTepKwIrwORcgsmlYAyG1i568NbLVdQKIkNUM 4-> ssh-ed25519 AaF/mQ g3X+bGZDBvMyt4OyIyYargTQCl+oYZ+4aNS+0WJVyAY
5w0GOzGfmd7s/mi3b1QTAl1ug3P+yUDRtpsWVw/ZSQEk 5jYmVeK+mcqqNh+4Y4FU7UyFT2BW97i6JLGoNzcxzSAs
6--- B9oYTFIRG8+V+Kk7/vr6B0HaklmJwF/Uzsq8iHDvNBc 6--- QXFnxxiwsrJd8fQQr1w07SwLfqQBmOQcEdpuRBanOKg
74uKr 78 &~w "*YFp@ˇO犜PcIZ7U3esk(z18W6XPQ!^nRwHs \ No newline at end of file
8ћ3㴂) V\P2ୠPgrӌ8kEת<D"˲+r:&3_BQ \ No newline at end of file
diff --git a/epistemia/secrets/wg0psk_hastur.age b/epistemia/secrets/wg0psk_hastur.age
index aa4d44b..4d04866 100644
--- a/epistemia/secrets/wg0psk_hastur.age
+++ b/epistemia/secrets/wg0psk_hastur.age
Binary files differ
diff --git a/epistemia/secrets/wg1_demiurge.age b/epistemia/secrets/wg1_demiurge.age
index 980fb4b..153052d 100644
--- a/epistemia/secrets/wg1_demiurge.age
+++ b/epistemia/secrets/wg1_demiurge.age
@@ -1,7 +1,7 @@
1age-encryption.org/v1 1age-encryption.org/v1
2-> ssh-ed25519 947m3A p1oWAwuUJIijt7GotoiOqeqFHKivz97kJyFjQkp0RgQ 2-> ssh-ed25519 947m3A XeQVp+qvHY/AdBfeRPZFm+PMw1zqARFE2nM0MHLBeV0
3+ZTwOWtNBO0o1et1frJdrLZ/tsUBdqzzgDPQjh5SYBE 31XUz1PU/AmieRcKKgczPv8Uw/Rk7rdG1hbc8iTtf3/s
4-> ssh-ed25519 AaF/mQ 2CuYuqUgygv0ZehtY4v/m8XIaqznJsJswjinPFPgtW0 4-> ssh-ed25519 AaF/mQ oLsTCKN7OfqAWJ6vf7UL6hUXleoiPMPyRgipANUuYU0
5F8kcda97DjtN86gM7XjGdRjeOrMYmVhZvrNRDGitovU 58AZkb3sMwdDf6yIdXGwz6pczraf3/lzih/LG/4hUsLM
6--- EIlaID8dIcmQi9BWCiWwFfAL+dSHwNDxPRG8HWn6xds 6--- tpy8xoo5+UO15V13cclmO3PKEBNtZnvnKDwB6KUnglU
7/q7_sڭb@1pz\2jcGɿAn`F^OA*~2Z}xLϝzA \ No newline at end of file 7 n^Jϝ}U&QOPDV& aH2Y8_CUe6"Oھ&7DK((E/qAh \ No newline at end of file
diff --git a/epistemia/secrets/wg1_hastur.age b/epistemia/secrets/wg1_hastur.age
index b71103d..38cb976 100644
--- a/epistemia/secrets/wg1_hastur.age
+++ b/epistemia/secrets/wg1_hastur.age
Binary files differ
diff --git a/epistemia/secrets/wg1_saklas.age b/epistemia/secrets/wg1_saklas.age
index a25bd40..be7391e 100644
--- a/epistemia/secrets/wg1_saklas.age
+++ b/epistemia/secrets/wg1_saklas.age
Binary files differ
diff --git a/epistemia/secrets/wg2_hastur.age b/epistemia/secrets/wg2_hastur.age
new file mode 100644
index 0000000..1929871
--- /dev/null
+++ b/epistemia/secrets/wg2_hastur.age
Binary files differ
diff --git a/epistemia/secrets/wpa_supplicant.age b/epistemia/secrets/wpa_supplicant.age
index 6f39ae6..91d7803 100644
--- a/epistemia/secrets/wpa_supplicant.age
+++ b/epistemia/secrets/wpa_supplicant.age
Binary files differ
diff --git a/epistemia/systems/hastur.scm b/epistemia/systems/hastur.scm
index b63e0b4..3f74a95 100644
--- a/epistemia/systems/hastur.scm
+++ b/epistemia/systems/hastur.scm
@@ -111,7 +111,10 @@
111 (file (local-file "../secrets/wg0psk_hastur.age"))) 111 (file (local-file "../secrets/wg0psk_hastur.age")))
112 (age-secret 112 (age-secret
113 (name "wg1_hastur") 113 (name "wg1_hastur")
114 (file (local-file "../secrets/wg1_hastur.age"))))))) 114 (file (local-file "../secrets/wg1_hastur.age")))
115 (age-secret
116 (name "wg2_hastur")
117 (file (local-file "../secrets/wg2_hastur.age")))))))
115 (simple-service 'zfs-loader 118 (simple-service 'zfs-loader
116 kernel-module-loader-service-type 119 kernel-module-loader-service-type
117 '("zfs")) 120 '("zfs"))
@@ -188,7 +191,7 @@
188 (service wireguard-service-type 191 (service wireguard-service-type
189 (wireguard-configuration 192 (wireguard-configuration
190 (interface "wg1") 193 (interface "wg1")
191 (addresses '("10.0.13.3/24" "fd00:b0ba:cafe:babe::3/64 ")) 194 (addresses '("10.0.13.3/24" "fd00:b0ba:cafe:babe::3/64"))
192 (port 51820) 195 (port 51820)
193 (bootstrap-private-key? #f) 196 (bootstrap-private-key? #f)
194 (private-key "/run/secrets/wg1_hastur") 197 (private-key "/run/secrets/wg1_hastur")
@@ -210,6 +213,24 @@
210 (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128")) 213 (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128"))
211 (endpoint "carcosa.13f0.net:51820") 214 (endpoint "carcosa.13f0.net:51820")
212 (keep-alive 25)))))) 215 (keep-alive 25))))))
216 (service wireguard-service-type
217 (wireguard-configuration
218 (interface "wg2")
219 (addresses '("10.0.14.2/24"))
220 (port 51822)
221 (bootstrap-private-key? #f)
222 (private-key "/run/secrets/wg2_hastur")
223 (shepherd-requirement '(age-secret wpa-supplicant))
224 (pre-up '("while [ ! -f /run/secrets/wg2_hastur ]; do sleep 1; done"
225 "while [ -z \"$(ip route show default)\" ]; do sleep 1; done"))
226 (peers
227 (list
228 (wireguard-peer
229 (name "abatur.epistemia")
230 (public-key "OOpc1K4S56FdJkCaqHx3DC4aIO+zQCAo8ACwCboLEjg=")
231 (allowed-ips '("10.0.14.1/32" "100.64.0.0/10"))
232 (endpoint "87.99.141.145:51822")
233 (keep-alive 25))))))
213 (service pam-limits-service-type 234 (service pam-limits-service-type
214 (list (pam-limits-entry "@audio" 'both 'rtprio 99) 235 (list (pam-limits-entry "@audio" 'both 'rtprio 99)
215 (pam-limits-entry "@audio" 'both 'memlock 'unlimited))) 236 (pam-limits-entry "@audio" 'both 'memlock 'unlimited)))
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-03 05:41:47 +0000