guixsd-config

GuixSD configs for my systems
Log | Files | Refs
commit be281ea8291bd94acf31883b5a84d12b6a89066b
parent d6ea4ce49907527a7f0981426b640e7b73bbd7b8
Author: vin <git@vineetk.net>
Date:   Tue, 28 Apr 2026 15:46:27 -0400

hastur: add wg2 vpn for tailscale bridge

Diffstat:

Mepistemia/secrets/email_13f0.age | 16+++++++---------


Mepistemia/secrets/email_vinbiz.age | 0


Mepistemia/secrets/email_vineetk.age | 15++++++++-------


Mepistemia/secrets/rekey.scm | 1+


Mepistemia/secrets/saklas_smtpd_dkim.age | 0


Mepistemia/secrets/saklas_smtpd_passwd.age | 0


Mepistemia/secrets/saklas_smtpd_virtuals.age | 0


Mepistemia/secrets/wg0_demiurge.age | 0


Mepistemia/secrets/wg0_hastur.age | 0


Mepistemia/secrets/wg0psk_demiurge.age | 15+++++++--------


Mepistemia/secrets/wg0psk_hastur.age | 0


Mepistemia/secrets/wg1_demiurge.age | 14+++++++-------


Mepistemia/secrets/wg1_hastur.age | 0


Mepistemia/secrets/wg1_saklas.age | 0


Aepistemia/secrets/wg2_hastur.age | 0


Mepistemia/secrets/wpa_supplicant.age | 0


Mepistemia/systems/hastur.scm | 25+++++++++++++++++++++++--


17 files changed, 53 insertions(+), 33 deletions(-)

diff --git a/epistemia/secrets/email_13f0.age b/epistemia/secrets/email_13f0.age
@@ -1,9 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 KXd7pg JA+X0qP4lZHscj7Ab0H6WnsCxy9gEkgonP6H6WtF1BI
-p4wWKg1f5EcKarC2TVOkhZCL5W6DPnGn992CYErST/g
--> ssh-ed25519 AaF/mQ UfWdAg/v4ZHheetWWhowrRycjhtmVDA33coPteQxgFg
-V9AjDexq0Fn9TDX55d2IEEIB9KvHcjIUW6K1VxNseMg
---- npGLxhYw6SHfQMaRQpbPAicNuGpBIuRZruDLfLSurPQ
-[LeAKv9?Z׹;&9f^)h3ҡs[A,+M'w>
-]{L>Jz
-$5Gb;V
-\ No newline at end of file
+-> ssh-ed25519 KXd7pg 3ynY12E0LLLdLSRgCzO09VphQeBJNdIQmkI2o2TWQR8
+j6mTyDW0Q5bztnwpWx3+pp/yBEbHDq6xk+hLcLuUYSM
+-> ssh-ed25519 AaF/mQ bW5AHW9v+qR90tl33Vi18bnHw6CpcEORHZHwtFPeths
+wwAoH2Tq6xZacVb6Z6f1/NkceNj9cnXDUPzxfVd/Bww
+--- 6ELNb4Arc/FnxV92/H6byhQbS4+4tpLvYepUWknrN8c
+*wЮT8jY"DVcdRuA"wڨ1v?XGZ>>(StjTzqw>APkx/L
+\ No newline at end of file
diff --git a/epistemia/secrets/email_vinbiz.age b/epistemia/secrets/email_vinbiz.age
Binary files differ.
diff --git a/epistemia/secrets/email_vineetk.age b/epistemia/secrets/email_vineetk.age
@@ -1,7 +1,8 @@
 age-encryption.org/v1
--> ssh-ed25519 KXd7pg MJmX/dmIv7JQ+snLvnhmAgiw6T1EkjCoYKmXiBBOwlo
-cj3y6LLsFWiG5ExZAi8bNcIjSiBTZgEt8JpTTVBB9Xc
--> ssh-ed25519 AaF/mQ LLgXnyqiGnTTGKD6e1bwu/YULJq5qEXfzqAG8Z/awV4
-s/660BRmbahOXMR8VVCyRXY0kYTWXRGVcy7K+MZRoTk
---- BDSl2ZiQKBMeGHGlQ+gIksrGYFph/jIA1T86qjwZYUQ
-1g0	bV@{!_v\_k``RYCo߫6_p?y~ׇZ$쓪(t $&[ΦY5<
-\ No newline at end of file
+-> ssh-ed25519 KXd7pg ojjTKqcrvwYGyWUP+NHl3x6ypIMx/PFS7b2sczUyxEI
+uq2/4eOfidjq+Fj0lefjSWuPzotmYR1A48/BiC+qQgI
+-> ssh-ed25519 AaF/mQ AyHpcN5Wsz2kh9U4ENTm+YtQoiScsAMikePd62LiGWw
+PYORjQ9akT1Kcq0Onx6zPm0A6p4wxPNuazHdf4LCdWU
+--- Sv54CL3Cf9+1UlEs08tDS5SVcBqh3Q9Me30uaU5QSyE
+7BIZfVw=[
+;wPGqfNN%zݝoorܥuw~^87
+\ No newline at end of file
diff --git a/epistemia/secrets/rekey.scm b/epistemia/secrets/rekey.scm
@@ -27,6 +27,7 @@
     ("wg0_hastur"            . ,hastur)
     ("wg0psk_hastur"         . ,hastur)
     ("wg1_hastur"            . ,hastur)
+    ("wg2_hastur"            . ,hastur)
     ("wpa_supplicant"        . ,hastur)))
 
 (define (run fmt . args)
diff --git a/epistemia/secrets/saklas_smtpd_dkim.age b/epistemia/secrets/saklas_smtpd_dkim.age
Binary files differ.
diff --git a/epistemia/secrets/saklas_smtpd_passwd.age b/epistemia/secrets/saklas_smtpd_passwd.age
Binary files differ.
diff --git a/epistemia/secrets/saklas_smtpd_virtuals.age b/epistemia/secrets/saklas_smtpd_virtuals.age
Binary files differ.
diff --git a/epistemia/secrets/wg0_demiurge.age b/epistemia/secrets/wg0_demiurge.age
Binary files differ.
diff --git a/epistemia/secrets/wg0_hastur.age b/epistemia/secrets/wg0_hastur.age
Binary files differ.
diff --git a/epistemia/secrets/wg0psk_demiurge.age b/epistemia/secrets/wg0psk_demiurge.age
@@ -1,8 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 947m3A Dh919UZSR7b8AjtEjXM6KeZTIDSGQWYCef+8IiTk+yg
-Bwu8OFPT/sYl5IBW2OB6yR6PE9gbZtKijJRdVCpvFSg
--> ssh-ed25519 AaF/mQ E2hpAaLTepKwIrwORcgsmlYAyG1i568NbLVdQKIkNUM
-w0GOzGfmd7s/mi3b1QTAl1ug3P+yUDRtpsWVw/ZSQEk
---- B9oYTFIRG8+V+Kk7/vr6B0HaklmJwF/Uzsq8iHDvNBc
-4uKr
-ћ3㴂)V\P2ୠPgrӌ8kEת<D"˲+r:&3_BQ
-\ No newline at end of file
+-> ssh-ed25519 947m3A UgHVFVeQDm9j/FIlqCp8PcQ2/yeArslKFhdldFoL+Rk
+JUvVep6kqYNPQAd0SqjeE4CNzjOqlHw+q+ZSrR7riUk
+-> ssh-ed25519 AaF/mQ g3X+bGZDBvMyt4OyIyYargTQCl+oYZ+4aNS+0WJVyAY
+jYmVeK+mcqqNh+4Y4FU7UyFT2BW97i6JLGoNzcxzSAs
+--- QXFnxxiwsrJd8fQQr1w07SwLfqQBmOQcEdpuRBanOKg
+8&~w"*YFp@ˇO犜PcIZ7U3esk(z18W6XPQ!^nRwHs
+\ No newline at end of file
diff --git a/epistemia/secrets/wg0psk_hastur.age b/epistemia/secrets/wg0psk_hastur.age
Binary files differ.
diff --git a/epistemia/secrets/wg1_demiurge.age b/epistemia/secrets/wg1_demiurge.age
@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 947m3A p1oWAwuUJIijt7GotoiOqeqFHKivz97kJyFjQkp0RgQ
-+ZTwOWtNBO0o1et1frJdrLZ/tsUBdqzzgDPQjh5SYBE
--> ssh-ed25519 AaF/mQ 2CuYuqUgygv0ZehtY4v/m8XIaqznJsJswjinPFPgtW0
-F8kcda97DjtN86gM7XjGdRjeOrMYmVhZvrNRDGitovU
---- EIlaID8dIcmQi9BWCiWwFfAL+dSHwNDxPRG8HWn6xds
-/q7_sڭb@1pz\2jcGɿAn`F^OA*~2Z}xLϝzA
-\ No newline at end of file
+-> ssh-ed25519 947m3A XeQVp+qvHY/AdBfeRPZFm+PMw1zqARFE2nM0MHLBeV0
+1XUz1PU/AmieRcKKgczPv8Uw/Rk7rdG1hbc8iTtf3/s
+-> ssh-ed25519 AaF/mQ oLsTCKN7OfqAWJ6vf7UL6hUXleoiPMPyRgipANUuYU0
+8AZkb3sMwdDf6yIdXGwz6pczraf3/lzih/LG/4hUsLM
+--- tpy8xoo5+UO15V13cclmO3PKEBNtZnvnKDwB6KUnglU
+n^Jϝ}U&QOPDV&aH2Y8_CUe6"Oھ&7DK((E/qAh
+\ No newline at end of file
diff --git a/epistemia/secrets/wg1_hastur.age b/epistemia/secrets/wg1_hastur.age
Binary files differ.
diff --git a/epistemia/secrets/wg1_saklas.age b/epistemia/secrets/wg1_saklas.age
Binary files differ.
diff --git a/epistemia/secrets/wg2_hastur.age b/epistemia/secrets/wg2_hastur.age
Binary files differ.
diff --git a/epistemia/secrets/wpa_supplicant.age b/epistemia/secrets/wpa_supplicant.age
Binary files differ.
diff --git a/epistemia/systems/hastur.scm b/epistemia/systems/hastur.scm
@@ -111,7 +111,10 @@
 								(file (local-file "../secrets/wg0psk_hastur.age")))
 							       (age-secret
 								(name "wg1_hastur")
-								(file (local-file "../secrets/wg1_hastur.age")))))))
+								(file (local-file "../secrets/wg1_hastur.age")))
+							       (age-secret
+								(name "wg2_hastur")
+								(file (local-file "../secrets/wg2_hastur.age")))))))
 					   (simple-service 'zfs-loader
 							   kernel-module-loader-service-type
 							   '("zfs"))
@@ -188,7 +191,7 @@
 					   (service wireguard-service-type
 						    (wireguard-configuration
 						     (interface "wg1")
-						     (addresses '("10.0.13.3/24" "fd00:b0ba:cafe:babe::3/64 "))
+						     (addresses '("10.0.13.3/24" "fd00:b0ba:cafe:babe::3/64"))
 						     (port 51820)
 						     (bootstrap-private-key? #f)
 						     (private-key "/run/secrets/wg1_hastur")
@@ -210,6 +213,24 @@
 							(allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128"))
 							(endpoint "carcosa.13f0.net:51820")
 							(keep-alive 25))))))
+					   (service wireguard-service-type
+						    (wireguard-configuration
+						     (interface "wg2")
+						     (addresses '("10.0.14.2/24"))
+						     (port 51822)
+						     (bootstrap-private-key? #f)
+						     (private-key "/run/secrets/wg2_hastur")
+						     (shepherd-requirement '(age-secret wpa-supplicant))
+						     (pre-up '("while [ ! -f /run/secrets/wg2_hastur ]; do sleep 1; done"
+							       "while [ -z \"$(ip route show default)\" ]; do sleep 1; done"))
+						     (peers
+						      (list
+						       (wireguard-peer
+							(name "abatur.epistemia")
+							(public-key "OOpc1K4S56FdJkCaqHx3DC4aIO+zQCAo8ACwCboLEjg=")
+							(allowed-ips '("10.0.14.1/32" "100.64.0.0/10"))
+							(endpoint "87.99.141.145:51822")
+							(keep-alive 25))))))
 					   (service pam-limits-service-type
 						    (list (pam-limits-entry "@audio" 'both 'rtprio 99)
 							  (pam-limits-entry "@audio" 'both 'memlock 'unlimited)))