nixos-config

commit b68745626dc70679de417bf1ab61334bf00b530e
parent 25935c191200f4cc48278ac6068d5f4b51efd88b
Author: vin <vin@vineetk.net>
Date:   Mon,  3 Mar 2025 00:57:20 -0500

saklas: start using agenix as well

Diffstat:
M
hosts/saklas/default.nix
 | 
57
+++++++++++++++++++++++++--------------------------------
A
secrets/hetzner_dns.age
 | 
11
+++++++++++
A
secrets/radicale_users.age
 | 
0

M
secrets/secrets.nix
 | 
5
++++-
A
secrets/tailscale_saklas.age
 | 
12
++++++++++++

5 files changed, 52 insertions(+), 33 deletions(-)
diff --git a/hosts/saklas/default.nix b/hosts/saklas/default.nix
@@ -5,6 +5,27 @@
     ./hardware.nix
   ];
 
+  # decrypt agenix secrets
+  age.secrets = {
+    hetzner_dns = {
+      file = ../../secrets/hetzner_dns.age;
+      owner = "root";
+      group = "root";
+    };
+
+    radicale_users = {
+      file = ../../secrets/radicale_users.age;
+      owner = "radicale";
+    };
+
+    tailscale_demiurge = {
+      file = ../../secrets/tailscale_saklas.age;
+      owner = "root";
+      group = "root";
+    };
+  };
+
+
   # disable wifi and open some ports
   networking = {
     hostName = "saklas";
@@ -17,37 +38,6 @@
       allowedTCPPorts = [ 22 80 443 ];
       allowedUDPPorts = [ 3478 41641 51820 ];
     };
-
-    # VPN
-    wireguard.interfaces = {
-      # vpn to vps
-      wg0 = {
-        ips = [ "10.0.13.1/24" ];
-        listenPort = 51820;
-        privateKey = "***REMOVED***";
-
-        peers = [
-          {
-            # demiurge
-            allowedIPs = [ "10.0.13.2/32" ];
-            publicKey = "kdvqM1fph4eglG33vCELCVIMKNu4ln/rm6MwcymeNUw=";
-            presharedKey = "***REMOVED***";
-          }
-          {
-            # lappy
-            allowedIPs = [ "10.0.13.3/32" ];
-            publicKey = "fqxxnp7mJAr52oBDjSd+J1iu3/RUUg++XCXtUfnLWhs=";
-            presharedKey = "***REMOVED***";
-          }
-          {
-            # iphonebob
-            allowedIPs = [ "10.0.13.4/32" ];
-            publicKey = "lZ4C67LdkE/zcMKyt5l8fKffieOz2yC7WN3v0w0OCTI=";
-            presharedKey = "***REMOVED***";
-          }
-        ];
-      };
-    };
   };
 
   systemd.network = {
@@ -127,7 +117,7 @@
       acceptTerms = true;
 
       defaults = {
-        credentialFiles."HETZNER_API_KEY_FILE" = "/run/secrets/hetzner-dns-api";
+        credentialFiles."HETZNER_API_KEY_FILE" = config.age.secrets.hetzner_dns.path;
         dnsProvider = "hetzner";
         email = "acme@vineetk.net";
         server = "https://acme-v02.api.letsencrypt.org/directory";
@@ -168,7 +158,10 @@
 
     tailscale = {
       enable = true;
+      authKeyFile = config.age.secrets.tailscale_demiurge.path;
       extraDaemonFlags = [ "--no-logs-no-support" ];
+      extraUpFlags = [ "--login-server=https://headscale.13f0.net" ];
+      openFirewall = true;
     };
 
     # web server and reverse proxy
diff --git a/secrets/hetzner_dns.age b/secrets/hetzner_dns.age
@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 AaF/mQ hK2xroga7vLhQxaIBFaP+nrJF8KIxrFaST2RdVedBEI
+vzgZ49FsgITyEUwwpMJllIohNE2BHpf634e6NUnuLyM
+-> ssh-ed25519 F30WWA vtiebrA6nc2DhyBGpFKUKv/PZhC89mfw4VJi5JEHekg
+LeeJAKYlywoNoTsbdCWoe+xGN4DDtBq/Zx2jjF5AXos
+-> ssh-ed25519 hc2ELA AYBEPYt0guu6DkCTq/DFPAuhDbyb0xlD/Q3YRD9r0TE
+t7r0IU70rRLIYuUiSbypwIBiwrkeeDbSr9A8rC57AUo
+--- YFPGnH20/JpT0vHriDFL3ZGHDElBuU6JU4ygDK87JQs
+t�j�R堸��}X%x�"���
+��Ic����k �܇��kR�܏�"p�s�$i;BVl8<�
+\ No newline at end of file
diff --git a/secrets/radicale_users.age b/secrets/radicale_users.age
Binary files differ.
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
@@ -7,6 +7,9 @@ let
   systems = [ demiurge saklas ];
 in
 {
-  "tailscale_demiurge.age".publicKeys = users ++ systems;
+  "hetzner_dns.age".publicKeys = users ++ systems;
+  "radicale_users.age".publicKeys = users ++ systems;
   "smallstep.age".publicKeys = users ++ systems;
+  "tailscale_demiurge.age".publicKeys = users ++ systems;
+  "tailscale_saklas.age".publicKeys = users ++ systems;
 }
diff --git a/secrets/tailscale_saklas.age b/secrets/tailscale_saklas.age
@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 AaF/mQ eUu7OoAObwNKVNHnf4gqC1tJ7xlmjkhW01G+HdcqAxc
+SwYGhawZISYmqHSyA7fqKs05IzVlVu+3+7zDgvBBbkQ
+-> ssh-ed25519 F30WWA A8NddnDcg3IlQ8wJhuLoj1oS9rvRaIzLWFR+zp5qjAA
+Rezb8NRw32cQSytyegAGW5s/knHQUseHoSTeHpmlJGs
+-> ssh-ed25519 hc2ELA za1uRZpbO1VkGdIVnNqYJkrJpCji/JEBq3lPolodhxU
+u/FlNi8t03cwOvdqmUGOMPhAbVmLnWHAbScYCAbTvxw
+--- BaEwzkb52piuKrSglC0P8xCr/HlD97B3WgklyyuBEbA
+�C��`
+fq�AO��4̛4�/�{W��᫇T����ƫ)��j_���dn��D�k��ACi��3
+�8(L^'I҆$�bg�p
+\ No newline at end of file