[fanny] fix flushing init vpn

machines/fanny/configuration.nix

@@ -91,6 +91,10 @@ in
 
   boot.initrd = {
     availableKernelModules = [ "wireguard" ];
+    # postMountCommands = ''
+    #   ip address flush dev wg-initrd
+    #   ip link set dev wg-initrd down
+    # '';
     systemd = {
       enable = true;
       network = {
@@ -102,15 +106,15 @@ in
           };
           wireguardConfig = { PrivateKeyFile = "/etc/secrets/30-wg-initrd.key"; };
           wireguardPeers = [{
-            AllowedIPs = peers.fanny-initrd.allowedIPs;
-            PublicKey = peers.fanny-initrd.publicKey;
+            AllowedIPs = peers.vpn.allowedIPs;
+            PublicKey = peers.vpn.publicKey;
             Endpoint = "${peers.vpn.publicIp}:${builtins.toString(peers.vpn.listenPort)}";
             PersistentKeepalive = 25;
           }];
         };
         networks."30-wg-initrd" = {
           name = "wg-initrd";
-          addresses = [{ Address = peers.fanny-initrd.address; }];
+          addresses = [{ Address = "${peers.fanny-initrd.address}/24"; }];
         };
       };
     };

machines/modules/malobeo/initssh.nix

@@ -42,30 +42,36 @@ in
       initrd = {
         availableKernelModules = cfg.ethernetDrivers;
         systemd = {
-          packages = [ pkgs.busybox ];
+          initrdBin = [ pkgs.busybox pkgs.wireguard-tools pkgs.iproute2 ]; 
           enable = true;
           network.enable = true;
+          services."stopInitVpn" = {
+            description = "stop init vpn";
+            wantedBy = [
+              "initrd.target"
+            ];
+            after = [
+              "zfs.target"
+            ];
+            serviceConfig.StandardOutput = "journal+console";
+            script = ''
+              networkctl down wg-initrd
+            '';
+            serviceConfig.Type = "oneshot";
       };
-        network.ssh = {
+        };
+        network = {
+          flushBeforeStage2 = true;
+          ssh = {
             enable = true;
             port = 222;
             authorizedKeys = cfg.authorizedKeys;
             hostKeys = [ "/etc/ssh/initrd" ];
           };
+        };
         secrets = {
           "/etc/ssh/initrd" = "/etc/ssh/initrd";
         };
-        systemd.services.zfs-remote-unlock = {
-          description = "Prepare for ZFS remote unlock";
-          wantedBy = ["initrd.target"];
-          after = ["systemd-networkd.service"];
-          path = with pkgs; [ zfs ];
-          serviceConfig.Type = "oneshot";
-          script = ''
-            zpool import storage
-            echo "zfs load-key -a; killall zfs; systemctl default" >> /var/empty/.profile
-          '';
-        };
       };
       kernelParams = [ "ip=::::${hostName}-initrd::dhcp" ];
     };

scripts/unlock-boot.sh

@@ -24,14 +24,16 @@ diskkey=$(sops -d machines/$hostname/secrets/disk.key)
 echo
 if [ $# = 1 ]
     then
-    echo "$diskkey" | ssh $sshoptions root@$hostname-initrd "systemd-tty-ask-password-agent" #root
+    ssh $sshoptions root@$hostname-initrd "zpool import -a"
+    echo "$diskkey" | ssh $sshoptions root@$hostname-initrd "zfs load-key storage/encrypted" #root
     echo "$diskkey" | ssh $sshoptions root@$hostname-initrd "systemd-tty-ask-password-agent" #data
 
 elif [ $# = 2 ]
     then
     ip=$2
-    echo "$diskkey" | ssh $sshoptions root@$ip "systemd-tty-ask-password-agent" #root
-    echo "$diskkey" | ssh $sshoptions root@$ip "systemd-tty-ask-password-agent" #data
+    ssh $sshoptions root@$ip "zpool import -a"
+    echo "$diskkey" | ssh $sshoptions root@$ip "zfs load-key storage/encrypted" 
+    echo "$diskkey" | ssh $sshoptions root@$ip "systemd-tty-ask-password-agent"
     
 else
     echo