guixsd-config

commit c779bf0d96acf0d093ea77d96e1b347f0ca16c80
parent 2549493c0a7a4930c62c03a50072ac7b14d3d28d
Author: Vineet Kumar <git@vineetk.net>
Date:   Sat, 24 Jan 2026 15:28:55 -0500

demiurge, saklas: move wg encrypted key to store

Diffstat:
M
epistemia/systems/demiurge.scm
 | 
12
+++++++-----
M
epistemia/systems/saklas.scm
 | 
5
+++--

2 files changed, 10 insertions(+), 7 deletions(-)
diff --git a/epistemia/systems/demiurge.scm b/epistemia/systems/demiurge.scm
@@ -204,8 +204,9 @@ rpz:
 						      (bootstrap-private-key? #f)
 						      (private-key
 						       #~(string-append "<("
-									#$(file-append age "/bin/age -d -i /data/ssh/id_ed25519")
-									" /data/src/public/guixsd-config/epistemia/secrets/wg0_demiurge.age)"))
+									#$(file-append age "/bin/age -d -i /etc/ssh/ssh_host_ed25519_key ")
+									#$(local-file "../secrets/wg0_demiurge.age")
+									")"))
 						      (pre-up '("ip route replace 79.127.222.207 via 192.168.1.1 dev eth0"))
 						      (post-up
 						       (list "ip rule add fwmark 0x1 table 100 priority 100"
@@ -237,8 +238,9 @@ rpz:
 						      (bootstrap-private-key? #f)
 						      (private-key
 						       #~(string-append "<("
-									#$(file-append age "/bin/age -d -i /data/ssh/id_ed25519")
-									" /data/src/public/guixsd-config/epistemia/secrets/wg1_demiurge.age)"))
+									#$(file-append age "/bin/age -d -i /etc/ssh/ssh_host_ed25519_key ")
+									#$(local-file "../secrets/wg1_demiurge.age")
+									")"))
 						      (table #f)
 						      (post-up
 						       ;; IPv4 and IPv6 NAT
@@ -266,7 +268,7 @@ rpz:
 							     #~(string-append #$(file-append wireguard-tools "/bin/wg") " set wg1 fwmark 51820")))
 						      (pre-down
 						       ;; IPv4 and IPv6 NAT
-						       (list "ip rule del to 157.180.125.215/32 lookup 51820"
+						       (list "ip rule del to 157.180.125.215/32 lookup 51820 || true"
 							     #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE")
 							     #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE")
 
diff --git a/epistemia/systems/saklas.scm b/epistemia/systems/saklas.scm
@@ -196,8 +196,9 @@ rpz:
 						      (bootstrap-private-key? #f)
 						      (private-key
 						       #~(string-append "<("
-									#$(file-append age "/bin/age -d -i /etc/ssh/ssh_host_ed25519_key")
-									" /data/src/public/guixsd-config/epistemia/secrets/wg1_saklas.age)"))
+									#$(file-append age "/bin/age -d -i /etc/ssh/ssh_host_ed25519_key ")
+									#$(local-file "../secrets/wg1_saklas.age")
+									")"))
 						      (peers
 						       (list
 							(wireguard-peer