From 68fdb8577359fcc139785806d5f843bf05e09285 Mon Sep 17 00:00:00 2001 From: vin Date: Wed, 22 Apr 2026 12:40:27 -0400 Subject: hastur: fix wireguard interfaces not starting on boot --- epistemia/systems/hastur.scm | 80 +++++++++++++++++++++++--------------------- 1 file changed, 41 insertions(+), 39 deletions(-) diff --git a/epistemia/systems/hastur.scm b/epistemia/systems/hastur.scm index 839821d..b63e0b4 100644 --- a/epistemia/systems/hastur.scm +++ b/epistemia/systems/hastur.scm @@ -167,47 +167,49 @@ ("root" ,(local-file "/data/ssh/id_ed25519.pub")))))) (service wireguard-service-type (wireguard-configuration - (interface "wg0") - (addresses '("10.179.194.21/32" "fd7d:76ee:e68f:a993:cee4:5b6c:bce1:9350/128")) - (port 51821) - (bootstrap-private-key? #f) - (shepherd-requirement '(age-secret networking)) - (private-key "/run/secrets/wg0_hastur") - (pre-up '("while [ ! -f /run/secrets/wg0_hastur ]; do sleep 1; done" - "ip route add 184.75.221.173 via $(ip route show default | cut -d' ' -f3) dev wlan0")) - (post-down '("ip route del 184.75.221.173")) - (peers - (list - (wireguard-peer - (name "airvpn-canada") - (public-key "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=") - (preshared-key "/run/secrets/wg0psk_hastur") - (allowed-ips '("0.0.0.0/0" "::0/0")) - (endpoint "184.75.221.173:1637")))))) + (interface "wg0") + (addresses '("10.179.194.21/32" "fd7d:76ee:e68f:a993:cee4:5b6c:bce1:9350/128")) + (port 51821) + (bootstrap-private-key? #f) + (shepherd-requirement '(age-secret wpa-supplicant)) + (private-key "/run/secrets/wg0_hastur") + (pre-up '("while [ ! -f /run/secrets/wg0_hastur ]; do sleep 1; done" + "while [ -z \"$(ip route show default)\" ]; do sleep 1; done" + "ip route add 184.75.221.173 via $(ip route show default | cut -d' ' -f3) dev wlan0")) + (post-down '("ip route del 184.75.221.173")) + (peers + (list + (wireguard-peer + (name "airvpn-canada") + (public-key "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=") + (preshared-key "/run/secrets/wg0psk_hastur") + (allowed-ips '("0.0.0.0/0" "::0/0")) + (endpoint "184.75.221.173:1637")))))) (service wireguard-service-type (wireguard-configuration - (interface "wg1") - (addresses '("10.0.13.3/24" "fd00:b0ba:cafe:babe::3/64 ")) - (port 51820) - (bootstrap-private-key? #f) - (private-key "/run/secrets/wg1_hastur") - (table #f) - (shepherd-requirement '(age-secret networking unbound)) - (pre-up '("while [ ! -f /run/secrets/wg1_hastur ]; do sleep 1; done")) - (peers - (list - (wireguard-peer - (name "saklas.epistemia") - (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=") - (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128")) - (endpoint "162.55.242.220:51820") - (keep-alive 25)) - (wireguard-peer - (name "demiurge.epistemia") - (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=") - (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128")) - (endpoint "carcosa.13f0.net:51820") - (keep-alive 25)))))) + (interface "wg1") + (addresses '("10.0.13.3/24" "fd00:b0ba:cafe:babe::3/64 ")) + (port 51820) + (bootstrap-private-key? #f) + (private-key "/run/secrets/wg1_hastur") + (table #f) + (shepherd-requirement '(age-secret unbound wpa-supplicant)) + (pre-up '("while [ ! -f /run/secrets/wg1_hastur ]; do sleep 1; done" + "while [ -z \"$(ip route show default)\" ]; do sleep 1; done")) + (peers + (list + (wireguard-peer + (name "saklas.epistemia") + (public-key "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=") + (allowed-ips '("10.0.13.1/32" "fd00:b0ba:cafe:babe::1/128")) + (endpoint "162.55.242.220:51820") + (keep-alive 25)) + (wireguard-peer + (name "demiurge.epistemia") + (public-key "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=") + (allowed-ips '("10.0.13.2/32" "fd00:b0ba:cafe:babe::2/128")) + (endpoint "carcosa.13f0.net:51820") + (keep-alive 25)))))) (service pam-limits-service-type (list (pam-limits-entry "@audio" 'both 'rtprio 99) (pam-limits-entry "@audio" 'both 'memlock 'unlimited))) -- cgit v1.2.3