guixsd-config

commit e44fd7af97ed0284dca634add18af187a7865693
parent 760182f382a85c15b2b95ee4c933883088fcbc57
Author: Vineet Kumar <git@vineetk.net>
Date:   Tue, 21 Apr 2026 00:11:20 -0400

demiurge, hastur: replace mullvad with airvpn-canada

Diffstat:
M
epistemia/secrets/email_13f0.age
 | 
16
+++++++++-------
M
epistemia/secrets/email_vinbiz.age
 | 
14
+++++++-------
M
epistemia/secrets/email_vineetk.age
 | 
15
+++++++--------
M
epistemia/secrets/rekey.scm
 | 
2
++
M
epistemia/secrets/saklas_smtpd_dkim.age
 | 
0

M
epistemia/secrets/saklas_smtpd_passwd.age
 | 
0

M
epistemia/secrets/saklas_smtpd_virtuals.age
 | 
0

M
epistemia/secrets/wg0_demiurge.age
 | 
0

M
epistemia/secrets/wg0_hastur.age
 | 
0

A
epistemia/secrets/wg0psk_demiurge.age
 | 
9
+++++++++
A
epistemia/secrets/wg0psk_hastur.age
 | 
0

M
epistemia/secrets/wg1_demiurge.age
 | 
14
+++++++-------
M
epistemia/secrets/wg1_hastur.age
 | 
0

M
epistemia/secrets/wg1_saklas.age
 | 
0

M
epistemia/secrets/wpa_supplicant.age
 | 
0

M
epistemia/systems/demiurge.scm
 | 
18
+++++++++++-------
M
epistemia/systems/hastur.scm
 | 
16
++++++++++------

17 files changed, 62 insertions(+), 42 deletions(-)
diff --git a/epistemia/secrets/email_13f0.age b/epistemia/secrets/email_13f0.age
@@ -1,7 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 KXd7pg BVzJiem1iZxiulpyx+4ojRwj3WNamXNBD2knCLjUZRs
-2dcdi+wJ0BOMGkQr9miSlWCjV7/t96nFOuRgd57p1tc
--> ssh-ed25519 AaF/mQ rOJ3QkU/uszpj4joGVoBLEH9qrzNEXlDqZ1oX4eivmo
-6fb1Utgr3/ONJoqqxabKQnZR7pKVBxKDNRGGiNeiuGA
---- rv7PF7U33gBhp4vKQSf9m2UME/oIOzLA1ICSHHsj14A
-�r������6n,��
N<:2w� %;:y�Kj�֜a�[ߟ���&�7@v�jm�8�,}�h/2Խ�S��h|~�2dەF�|?ܿ`�ޣ+~-9�H�
-\ No newline at end of file
+-> ssh-ed25519 KXd7pg JA+X0qP4lZHscj7Ab0H6WnsCxy9gEkgonP6H6WtF1BI
+p4wWKg1f5EcKarC2TVOkhZCL5W6DPnGn992CYErST/g
+-> ssh-ed25519 AaF/mQ UfWdAg/v4ZHheetWWhowrRycjhtmVDA33coPteQxgFg
+V9AjDexq0Fn9TDX55d2IEEIB9KvHcjIUW6K1VxNseMg
+--- npGLxhYw6SHfQMaRQpbPAicNuGpBIuRZruDLfLSurPQ
+�[��L�����eA�Kv9?�Z��׹�;&��9�f
�^)h������3ҡs[A,�+M�'�w��>
+]{�L��>Jz
+�$5G���b��;�V�
+\ No newline at end of file
diff --git a/epistemia/secrets/email_vinbiz.age b/epistemia/secrets/email_vinbiz.age
@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 KXd7pg sHZ6ZR85tnMWUgqoB4wR5nZ4+YKInVE033HI95Tum24
-M3EnFdK8Jk3+XxOJBJxTpdOn0OM4aAHycIgv4LaFhNw
--> ssh-ed25519 AaF/mQ NUDbCTR45dB1Kz3OUNjXasq50rSSM/yvr034ajtdhiQ
-QBawlLGdnjkIaCWkoWAOtXp/udQj1xEN26agMlVnYsA
---- 6n3CHhOdxLaLxDJP4KucTgcZJUcJxPmEaE4PBkekBfA
-7i�f��Y�����z����u�e����Pҡ�G��e_Vt�v�;6p�~��ě���.�<^A��9���#UƑ9�N�b��.�H#�mi�e
-\ No newline at end of file
+-> ssh-ed25519 KXd7pg 3PfxaiNyQHxe0vYDL9NWe4700A2Fv74NLsqDr4fPoHU
+xNLV9uqY3WkA6y5EGJeXYtqTKQ+DlvxYz/mi42NduWw
+-> ssh-ed25519 AaF/mQ f5751Z6ihRX4PZile5tgJfPDhNbAS9HTbs9g02+TvBg
+Lzi/keCI3ITOI6CvninM4beN6syfUe0R/o2E7ylDry8
+--- bQgxGoaO4JAagc1g4dR0z0+uAQz7TNSVs0BV2n1aqqw
+�*5���#�����B��e���'b[F�*Q}��[���օ�,���o��M�	;O�@����f��Wɶ�mL1�U�4�<��W��92��
+\ No newline at end of file
diff --git a/epistemia/secrets/email_vineetk.age b/epistemia/secrets/email_vineetk.age
@@ -1,8 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 KXd7pg FuyMspTJMb8P7Ni5L6fW/mnQmgT1b4btsXxt/K0sImI
-6q3Ur98AKqdNsINE7tzZERuCt+PTaGI87z/UQEdxvFw
--> ssh-ed25519 AaF/mQ OBp32nFNTsbeUT5dN2dmsl2usYOckS07mmz+OclLTz0
-La3VaLd8+LMGU1tm3y1W0kiWIELWWaWVbB/pcwLBnHs
---- auDDMUepJ16EB5t0eriBnlzAT5Ogsh+sawEAxpUTG20
-����^緁�N��>X7�*��T��R]
-�X�s1��B+�$�,�-/��ÒW��̽��$�Y��@%�ۑ����Q�.Nz!�L"u����d
-\ No newline at end of file
+-> ssh-ed25519 KXd7pg MJmX/dmIv7JQ+snLvnhmAgiw6T1EkjCoYKmXiBBOwlo
+cj3y6LLsFWiG5ExZAi8bNcIjSiBTZgEt8JpTTVBB9Xc
+-> ssh-ed25519 AaF/mQ LLgXnyqiGnTTGKD6e1bwu/YULJq5qEXfzqAG8Z/awV4
+s/660BRmbahOXMR8VVCyRXY0kYTWXRGVcy7K+MZRoTk
+--- BDSl2ZiQKBMeGHGlQ+gIksrGYFph/jIA1T86qjwZYUQ
+1�g�0	��b�V@{!_�v\�_k�`��`RYC�o�߫6��_p������?�y����~ׇZ$�쓪(t�� ��$�&��[Φ���Y5�<
+\ No newline at end of file
diff --git a/epistemia/secrets/rekey.scm b/epistemia/secrets/rekey.scm
@@ -22,8 +22,10 @@
     ("saklas_smtpd_passwd"   . ,saklas)
     ("saklas_smtpd_virtuals" . ,saklas)
     ("wg0_demiurge"          . ,demiurge)
+    ("wg0psk_demiurge"       . ,demiurge)
     ("wg1_demiurge"          . ,demiurge)
     ("wg0_hastur"            . ,hastur)
+    ("wg0psk_hastur"         . ,hastur)
     ("wg1_hastur"            . ,hastur)
     ("wpa_supplicant"        . ,hastur)))
 
diff --git a/epistemia/secrets/saklas_smtpd_dkim.age b/epistemia/secrets/saklas_smtpd_dkim.age
Binary files differ.
diff --git a/epistemia/secrets/saklas_smtpd_passwd.age b/epistemia/secrets/saklas_smtpd_passwd.age
Binary files differ.
diff --git a/epistemia/secrets/saklas_smtpd_virtuals.age b/epistemia/secrets/saklas_smtpd_virtuals.age
Binary files differ.
diff --git a/epistemia/secrets/wg0_demiurge.age b/epistemia/secrets/wg0_demiurge.age
Binary files differ.
diff --git a/epistemia/secrets/wg0_hastur.age b/epistemia/secrets/wg0_hastur.age
Binary files differ.
diff --git a/epistemia/secrets/wg0psk_demiurge.age b/epistemia/secrets/wg0psk_demiurge.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 947m3A Dh919UZSR7b8AjtEjXM6KeZTIDSGQWYCef+8IiTk+yg
+Bwu8OFPT/sYl5IBW2OB6yR6PE9gbZtKijJRdVCpvFSg
+-> ssh-ed25519 AaF/mQ E2hpAaLTepKwIrwORcgsmlYAyG1i568NbLVdQKIkNUM
+w0GOzGfmd7s/mi3b1QTAl1ug3P+yUDRtpsWVw/ZSQEk
+--- B9oYTFIRG8+V+Kk7/vr6B0HaklmJwF/Uzsq8iHDvNBc
+4���u�K�r��
+ћ�3㴂)�V\��P�2ୠPgrӌ8kE��ת���<D"�˲+�r:��&3�_B�Q
+\ No newline at end of file
diff --git a/epistemia/secrets/wg0psk_hastur.age b/epistemia/secrets/wg0psk_hastur.age
Binary files differ.
diff --git a/epistemia/secrets/wg1_demiurge.age b/epistemia/secrets/wg1_demiurge.age
@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 947m3A VE7d99QEYqGoAKO4HNwhwYcSM8tSwUvnEamwhdQEDkY
-bgu15jNJnZqJhKJ3qfxsx5dTaB63k28ec0oamAnd9Rc
--> ssh-ed25519 AaF/mQ gUsO4ZFgWINwRaVUuCiSEFDlIjA8uwDsay1uA20MTFk
-AmEViQLzuUpMdu9sfmfFdUquO2WOCtUyKx0IPVpgQmc
---- 5+zMCLf6ON6fa7a82dFS08XKSwfiCx0pTOka12mf9Po
-'�"U�P���4�Hb5e���p$�*)�sx7���Q֌����"�1xC���ݗ��1��K�gF��L�8P�Y�=|�
-\ No newline at end of file
+-> ssh-ed25519 947m3A p1oWAwuUJIijt7GotoiOqeqFHKivz97kJyFjQkp0RgQ
++ZTwOWtNBO0o1et1frJdrLZ/tsUBdqzzgDPQjh5SYBE
+-> ssh-ed25519 AaF/mQ 2CuYuqUgygv0ZehtY4v/m8XIaqznJsJswjinPFPgtW0
+F8kcda97DjtN86gM7XjGdRjeOrMYmVhZvrNRDGitovU
+--- EIlaID8dIcmQi9BWCiWwFfAL+dSHwNDxPRG8HWn6xds
+�/q7�_��sڭb��@1pz\�2��j��c���GɿA��n��`F^OA�*���~2Z�}��x�L�ϝ��z�A
+\ No newline at end of file
diff --git a/epistemia/secrets/wg1_hastur.age b/epistemia/secrets/wg1_hastur.age
Binary files differ.
diff --git a/epistemia/secrets/wg1_saklas.age b/epistemia/secrets/wg1_saklas.age
Binary files differ.
diff --git a/epistemia/secrets/wpa_supplicant.age b/epistemia/secrets/wpa_supplicant.age
Binary files differ.
diff --git a/epistemia/systems/demiurge.scm b/epistemia/systems/demiurge.scm
@@ -117,6 +117,9 @@
 							       (name "wg0_demiurge")
 							       (file (local-file "../secrets/wg0_demiurge.age")))
 							      (age-secret
+							       (name "wg0psk_demiurge")
+							       (file (local-file "../secrets/wg0psk_demiurge.age")))
+							      (age-secret
 							       (name "wg1_demiurge")
 							       (file (local-file "../secrets/wg1_demiurge.age")))))))
 					  (simple-service 'zfs-loader
@@ -170,21 +173,21 @@
 					  (service wireguard-service-type
 						   (wireguard-configuration
 						    (interface "wg0")
-						    (addresses '("10.68.117.111/32" "fc00:bbbb:bbbb:bb01::5:756e/128"))
+						    (addresses '("10.185.39.56/32" "fd7d:76ee:e68f:a993:a29b:21bb:332:cbac/128"))
 						    (port 51821)
 						    (bootstrap-private-key? #f)
 						    (private-key "/run/secrets/wg0_demiurge")
 						    (pre-up '("while [ ! -f /run/secrets/wg0_demiurge ]; do sleep 1; done"
-							      "ip route replace 79.127.222.207 via 192.168.1.1 dev eth0"))
+							      "ip route replace 184.75.208.244 via 192.168.1.1 dev eth0"))
 						    (post-up
 						     (list "ip rule add fwmark 0x1 table 100 priority 100"
 							   "ip rule add fwmark 51820 table 100 priority 100"
-							   "ip route add default via 192.168.1.1 dev eth0 table 100"
+							   "ip route replace default via 192.168.1.1 dev eth0 table 100"
 							   #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1")
 							   #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -j CONNMARK --restore-mark")
 							   #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark")))
 						    (post-down
-						     (list "ip route del 79.127.222.207 via 192.168.1.1 dev eth0"
+						     (list "ip route del 184.75.208.244 via 192.168.1.1 dev eth0"
 							   "ip rule del fwmark 0x1 table 100"
 							   "ip rule del fwmark 51820 table 100"
 							   "ip route flush table 100"
@@ -194,10 +197,11 @@
 						    (peers
 						     (list
 						      (wireguard-peer
-						       (name "mullvad-fi-hel-wg-003")
-						       (public-key "FKodo9V6BehkNphL+neI0g4/G/cjbZyYhoptSWf3Si4=")
+						       (name "airvpn-canada")
+						       (public-key "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=")
+						       (preshared-key "/run/secrets/wg0psk_demiurge")
 						       (allowed-ips '("0.0.0.0/0" "::0/0"))
-						       (endpoint "185.204.1.219:51820"))))))
+						       (endpoint "184.75.208.244:1637"))))))
 					  (service wireguard-service-type
 						   (wireguard-configuration
 						    (interface "wg1")
diff --git a/epistemia/systems/hastur.scm b/epistemia/systems/hastur.scm
@@ -107,6 +107,9 @@
 								(name "wg0_hastur")
 								(file (local-file "../secrets/wg0_hastur.age")))
 							       (age-secret
+								(name "wg0psk_hastur")
+								(file (local-file "../secrets/wg0psk_hastur.age")))
+							       (age-secret
 								(name "wg1_hastur")
 								(file (local-file "../secrets/wg1_hastur.age")))))))
 					   (simple-service 'zfs-loader
@@ -165,21 +168,22 @@
 					   (service wireguard-service-type
 						    (wireguard-configuration
 						      (interface "wg0")
-						      (addresses '("10.68.117.111/32" "fc00:bbbb:bbbb:bb01::5:756e/128"))
+						      (addresses '("10.179.194.21/32" "fd7d:76ee:e68f:a993:cee4:5b6c:bce1:9350/128"))
 						      (port 51821)
 						      (bootstrap-private-key? #f)
 						      (shepherd-requirement '(age-secret networking))
 						      (private-key "/run/secrets/wg0_hastur")
 						      (pre-up '("while [ ! -f /run/secrets/wg0_hastur ]; do sleep 1; done"
-								"ip route add 185.204.1.219 via $(ip route show default | cut -d' ' -f3) dev wlan0"))
-						      (post-down '("ip route del 185.204.1.219"))
+								"ip route add 184.75.221.173 via $(ip route show default | cut -d' ' -f3) dev wlan0"))
+						      (post-down '("ip route del 184.75.221.173"))
 						      (peers
 						       (list
 							(wireguard-peer
-							  (name "mullvad-fi-hel-wg-003")
-							  (public-key "FKodo9V6BehkNphL+neI0g4/G/cjbZyYhoptSWf3Si4=")
+							  (name "airvpn-canada")
+							  (public-key "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=")
+							  (preshared-key "/run/secrets/wg0psk_hastur")
 							  (allowed-ips '("0.0.0.0/0" "::0/0"))
-							  (endpoint "185.204.1.219:51820"))))))
+							  (endpoint "184.75.221.173:1637"))))))
 					   (service wireguard-service-type
 						    (wireguard-configuration
 						      (interface "wg1")