From 058bfbfa8fc9d4a945f2455be24b02f96e8bdbe8 Mon Sep 17 00:00:00 2001 From: vin Date: Sun, 21 Sep 2025 14:22:46 -0400 Subject: switch to exwm --- home.nix | 18 ++++- hosts/demiurge/default.nix | 164 +++++++++++------------------------------ secrets/secrets.nix | 5 +- secrets/tailscale_demiurge.age | Bin 0 -> 384 bytes secrets/tailscale_hastur.age | 7 ++ secrets/tailscale_saklas.age | 8 ++ 6 files changed, 78 insertions(+), 124 deletions(-) create mode 100644 secrets/tailscale_demiurge.age create mode 100644 secrets/tailscale_hastur.age create mode 100644 secrets/tailscale_saklas.age diff --git a/home.nix b/home.nix index ee8c5ba..26f3934 100644 --- a/home.nix +++ b/home.nix @@ -129,9 +129,9 @@ in ]; sessionVariables = { - EDITOR = "nvim"; - VISUAL = "nvim"; - PAGER = "page"; + EDITOR = "emacsclient -r"; + VISUAL = "emacsclient -t"; + PAGER = "less"; LESS = "-iR"; LESSHISTFILE = "/dev/null"; BROWSER = "qutebrowser"; @@ -304,6 +304,8 @@ in aerc.enable = true; + emacs.enable = true; + foot = { enable = true; @@ -638,6 +640,16 @@ in poweralertd.enable = true; + emacs = { + enable = false; + client.enable = true; + startWithUserSession = true; + extraOptions = [ + "-f" + "exwm-wm-mode" + ]; + }; + redshift = { enable = false; dawnTime = "07:00"; diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix index f3259df..9c781ca 100644 --- a/hosts/demiurge/default.nix +++ b/hosts/demiurge/default.nix @@ -59,7 +59,7 @@ # decrypt agenix secrets age.secrets = { wg0_demiurge.file = ../../secrets/wg0_demiurge.age; - wg1_demiurge.file = ../../secrets/wg1_demiurge.age; + tailscale_demiurge.file = ../../secrets/tailscale_demiurge.age; }; # boot options @@ -120,109 +120,33 @@ interface = "eth0"; }; - wireguard.interfaces = { - # mullvad - wg0 = { - ips = [ - "10.68.117.111/32" - "fc00:bbbb:bbbb:bb01::5:756e/128" - ]; - privateKeyFile = config.age.secrets.wg0_demiurge.path; - - postSetup = '' - ip route add 45.134.142.206 via 192.168.1.1 - ip route add default via 45.134.142.206 - ''; - postShutdown = '' - ip route del default via 45.134.142.206 - ip route del 45.134.142.206 via 192.168.1.1 - ''; - - peers = [ - { - allowedIPs = [ - "0.0.0.0/0" - "::0/0" - ]; - endpoint = "45.134.142.206:51820"; - publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw="; - } - ]; - }; - - # epistemia - wg1 = { - ips = [ - "10.0.13.2/24" - "fd00:b0ba:cafe:babe::2/64" - ]; - privateKeyFile = config.age.secrets.wg1_demiurge.path; - listenPort = 51820; - fwMark = "51821"; - mtu = 1420; - - #table = "Off"; - postSetup = '' - ip rule add from 10.0.13.0/24 lookup main pref 31000 - ip rule add from all fwmark 51821 lookup 51821 pref 32000 - ip route replace default via 192.168.1.1 dev eth0 table 51821 - - # NAT iphonebob and allow traffic between peers (when routing through demiurge) - ${pkgs.iptables}/bin/iptables -F FORWARD - ${pkgs.iptables}/bin/iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE - ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -o wg1 -j ACCEPT - ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -o wg0 -j ACCEPT - ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT - ''; - preShutdown = '' - ip rule del from all fwmark 51821 lookup 51821 pref 32000 - ip rule del from 10.0.13.0/24 lookup main pref 31000 - ip route flush table 51821 - - ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE - ${pkgs.iptables}/bin/iptables -F FORWARD - ''; - - peers = [ - # saklas - { - allowedIPs = [ - "10.0.13.1/32" - "fd00:b0ba:cafe:babe::1/128" - ]; - endpoint = "157.180.125.215:51820"; - persistentKeepalive = 25; - publicKey = "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0="; - } - # hastur - { - allowedIPs = [ - "10.0.13.3/32" - "fd00:b0ba:cafe:babe::3/128" - ]; - persistentKeepalive = 25; - publicKey = "MOmRjVbRuWEuK0oHQ+C0jTaceCUPd2fpzDbh8ue6bDc="; - } - # iphonebob - { - allowedIPs = [ - "10.0.13.4/32" - "fd00:b0ba:cafe:babe::4/128" - ]; - persistentKeepalive = 25; - publicKey = "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30="; - } - # lab - { - allowedIPs = [ - "10.0.13.5/32" - "fd00:b0ba:cafe:babe::5/128" - ]; - persistentKeepalive = 25; - publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE="; - } - ]; - }; + # mullvad + wireguard.interfaces.wg0 = { + ips = [ + "10.68.117.111/32" + "fc00:bbbb:bbbb:bb01::5:756e/128" + ]; + privateKeyFile = config.age.secrets.wg0_demiurge.path; + + postSetup = '' + ip route add 45.134.142.206 via 192.168.1.1 + ip route add default via 45.134.142.206 + ''; + postShutdown = '' + ip route del default via 45.134.142.206 + ip route del 45.134.142.206 via 192.168.1.1 + ''; + + peers = [ + { + allowedIPs = [ + "0.0.0.0/0" + "::0/0" + ]; + endpoint = "45.134.142.206:51820"; + publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw="; + } + ]; }; }; @@ -390,6 +314,19 @@ }; }; + # vpn + tailscale = { + enable = true; + authKeyFile = config.age.secrets.tailscale_demiurge.path; + disableTaildrop = true; + disableUpstreamLogging = true; + extraSetFlags = [ "--advertise-exit-node" ]; + #extraUpFlags = [ "--login-server=https://headscale.13f0.net" ]; + extraUpFlags = [ "--login-server=https://controlplane.tailscale.com" ]; + openFirewall = true; + useRoutingFeatures = "both"; + }; + # automatically scrub zfs pools (every week by default) zfs.autoScrub.enable = true; @@ -1154,21 +1091,10 @@ # extra systemd stuff systemd.services = { - nginx = { - after = [ "wireguard-wg1.service" ]; - requires = [ "wireguard-wg1.service" ]; - serviceConfig.Type = lib.mkForce "idle"; - }; - - wireguard-wg0 = { - after = [ "network-addresses-eth0.service" ]; - requires = [ "network-addresses-eth0.service" ]; - }; - - wireguard-wg1 = { - after = [ "wireguard-wg0.service" ]; - requires = [ "wireguard-wg0.service" ]; - }; + #nginx = { + # after = [ "wireguard-wg1.service" ]; + # serviceConfig.Type = lib.mkForce "idle"; + #}; }; # create caches and use mandoc diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 0d46c6d..4bfeab9 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -20,8 +20,9 @@ in "wg0_demiurge.age".publicKeys = users ++ [ demiurge ]; "wg0_hastur.age".publicKeys = users ++ [ hastur ]; - "wg1_demiurge.age".publicKeys = users ++ [ demiurge ]; - "wg1_hastur.age".publicKeys = users ++ [ hastur ]; + "tailscale_demiurge.age".publicKeys = users ++ [ demiurge ]; + "tailscale_hastur.age".publicKeys = users ++ [ hastur ]; + "tailscale_saklas.age".publicKeys = users ++ [ saklas ]; "wpa_supplicant.age".publicKeys = users ++ [ hastur ]; } diff --git a/secrets/tailscale_demiurge.age b/secrets/tailscale_demiurge.age new file mode 100644 index 0000000..a855cf0 Binary files /dev/null and b/secrets/tailscale_demiurge.age differ diff --git a/secrets/tailscale_hastur.age b/secrets/tailscale_hastur.age new file mode 100644 index 0000000..420e7c8 --- /dev/null +++ b/secrets/tailscale_hastur.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 AaF/mQ ZhtqaDNCYfckXuWoIPlmf6VMSZIbEoKROUTVsC3QJ2w +bQVjId8jiQXIUarsPUYwLEGof4W4b2gEOnL6ndd7hB8 +-> ssh-ed25519 CQpZUw f3XFvZLovkTydK2odqGU0UZd58s273diGLtku4uLSzQ +puBoVJ9Cb+m00M1UivQBD2NbxB9QJgeg0W+tv49WW2I +--- /4rFWR1tyCNnBgRlmH6Yku2GQwASTJ4GQbyQii0TZAo +E,;l&L/@q.x8(,hӾ_їY;aˌh`Zn(D5T ͒,فrr:SzkjG \ No newline at end of file diff --git a/secrets/tailscale_saklas.age b/secrets/tailscale_saklas.age new file mode 100644 index 0000000..b654cbc --- /dev/null +++ b/secrets/tailscale_saklas.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 AaF/mQ CFompU5/+edOgTq43LDiW2D1QfWrOCDraA81AwkBfGM +IxCXSQGTxY5XudpDZsszmRv6PTMwsuGjO926gABKfIY +-> ssh-ed25519 hc2ELA LitSyMM/w8BfhK6KlXu3Vcyc8nw1gMPHnXgnaWB1tDc +lw5E5c5eoPj5H4kdg3P23LTY+Rp3tdfui8vchHwN8Y0 +--- JjsrCNKCL69/V8ullEAbaYmCxmP3LSnjl6BT0HnWZV4 +tpM^/BPhH"WP#m/ƶږ 1 +8dHޝQMhA "# m fśф}FCyH \ No newline at end of file -- cgit v1.2.3