[ns1] deploy on fanny

machines/.sops.yaml

@@ -17,6 +17,7 @@ keys:
   - &machine_vaultwarden age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an
   - &machine_pretalx age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g
   - &machine_albert age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn
+  - &machine_ns1 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
   #this dummy key is used for testing.
   - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
 creation_rules:
@@ -123,6 +124,13 @@ creation_rules:
       age:
       - *admin_atlan
       - *machine_albert
+  - path_regex: ns1/secrets.yaml$
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *admin_atlan
   - path_regex: .*/secrets/.*
     key_groups:
     - pgp:

machines/fanny/configuration.nix

@@ -147,6 +147,7 @@ in
     "vaultwarden"
     "pretalx"
     "antamap" 
+    "ns1"
   ];
 
   networking = {

machines/modules/malobeo/peers.nix

@@ -65,4 +65,11 @@
     allowedIPs = [ "10.100.0.20/32" ];
     publicKey = "Pp55Jg//jREzHdbbIqTXc9N7rnLZIFw904qh6NLrACE=";
   };
+
+  "ns1" = {
+    role = "client";
+    address = "10.100.0.21";
+    allowedIPs = [ "10.100.0.21/32" ];
+    publicKey = "jozMsP5MA2uz7eOrXG8LB8mr2tHVa6FL1+tbMQs9ySk=";
+  };
 }

machines/modules/malobeo/wireguard.nix

@@ -72,6 +72,7 @@ in
           mtu = 1340; #seems to be necessary to proxypass nginx traffic through vpn
           address = [ "${myPeer.address}/24" ];
           autostart = cfg.autostart;
+          dns = peers.ns1.address;
           listenPort = mkIf (myPeer.role == "server") myPeer.listenPort;
 
           # This allows the wireguard server to route your traffic to the internet and hence be like a VPN

machines/ns1/dummy.yaml

@@ -0,0 +1,64 @@
+wg_private: ENC[AES256_GCM,data:KnlCYE1/WjhNLfazuKViiVKZLPqQHwwqX1o2Irxaoj6oa54s6vBoiHVste4=,iv:ZAqdUSGwzbrLjskAntzmcNCcIjyePG+awYRkSgi6tZg=,tag:vllLI+0dbuFlkcdaYsBqYQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBSDdNMUxFRGROR2YwN0Vn
+            SjlqVXV5SmVwOXdWcmgrOUswNnB6YitYeTJvClcrVk53d1FBUndSQWgxRVVySnFl
+            bVp4R3hHWmtGQW9lWER4L0tmTzdjc00KLS0tIFJRUHlMMGlvOVplTGNGNUo3NWNw
+            azVxT1hPUUZ4Wmc4QjNGcEtUcDFqd1kKZU2LEJsStdOspRE1CmbXevkQDfPHTuWp
+            k4AOM/W2T1Jz70pPl4M+Xg8oCJ5TNaURnvCxuiaBgAtQuZC7OR/Pnw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHMlE1bGVyWkdOOHdja1pM
+            OUhRU2VCVDhEZ3kxVDRzb0Z4YUxOeFZFTVdJCjlWd2NlUmcwU3dQb1pMT2U0a1ZO
+            Zk5HNVJtQWREMWpXVG9ZVkd2QkVjeVkKLS0tIHBXbDUrcjl5VXNXT3JPTThIYVFa
+            TEtTb1pNUjVUM3dBVFRJMUpnNng2bEkKBfxqOkJ4R4RMl4AYMmFXq0dYeiH8UuwB
+            1ozr78TT5ksdRHuYmOyJzAG3Q14tK/+h1tcSmh5bXIZtuzJzZKN4kw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+    lastmodified: "2026-09-10T15:02:33Z"
+    mac: ENC[AES256_GCM,data:e03qvt+6PI5FsKtV4aK1XhX1RCzzsvAf42/NOau5kEa0pRaSM+ajTJSD+06oC35gBYwB3w9Hq1ubFZVvZM3vgqITSNzCNJr7ft6LI48Srq0VjtKoGmjKqETYTTSNhbisNCI+sU13pdV18BESHE5eIGY/0KHcSeF1vG7Ys2DMTwM=,iv:cmfCkTMj5+NxWgBIthg2MaG39CYOsZdqTOMszOiOmY0=,tag:a4ooDhkCtLZm/s1O0tNGug==,type:str]
+    pgp:
+        - created_at: "2026-09-10T15:02:19Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQv/Wz+3/F+/IPsaVUZbJ6GB8V5HkowP7KCzWJOxwY3B3Yhl
+            H4Qir6G6aT2CpD5hHy+zEFw7s5t+MILybyzMZqNocjuQWIrF/YIYUbTDKK6rgSzC
+            tx0E6DcndBf69eK2wL8Um19/boB+MTN3DQSUom6Jpvg7WGo0NjtDexAqwSpJwFFF
+            di2DoUDHyTUUdHTcD+hfODTiQYC7cp51hZ6n3JACu1toGNfre1A/PtoSOTYP9i2p
+            aIIWBSciT4K1RJnIhV4fpU7wh7gi0O4xS1XZnTQ/SOA26sHp8wObLvi3TwF5AKum
+            dYyuCinJGMep7VBjBf7eJ73TI4CD1QM+MEQTzegPVlo54LvqSqwp8ZwHdIZi9gQ4
+            3Vku2hGSOI9SmOjOR5GGEYfJS3BbbF9rJCnamBhZVVO5lXbFtZqWi0JOu8U4Esnw
+            DTzLDOJpajEo7YxADD7yyLlFXDRtMNgU91hCjBLz76SgExI3avWq3Mm+KZXI4xCt
+            L0yENHriidkFR2T/uV4w0lYBAPOSvPnvxK92VEa1oDrhIjcFd0JwH/XsrYq/nih6
+            4PBf4U5DdO+ulJOj6MXV0QmsZXMObX8LWh6myufRTPIPl6wA5SeSvleDuiWQKYdW
+            j0rqALTicw==
+            =mpXh
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-09-10T15:02:19Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ/9EqodWqh61g7Uv1L/oF8PMMsONmprOg+17Xvn33xI8Pam
+            SjiEaGh8qZRJckFPdWgw1QNfpzFnEjpJEYMQ46oHJxlLMd5T4eqOTHbmPC3IAktm
+            lg3yYRmHEhyrngmQPTnoKuNQg6YDhzorHsfD98Tf0zA0B9AGCukgDZoEUs2oXwsY
+            PiZYcTcgB8z/8petU9YlieO7frm17Srso5JfOfIlu88vtlAeu3z8LZl5iKl34Lxz
+            +2TGAz/6YTYx24Tmj9qWpRYYPpbnQNUTkm+D9eDts6Pz1SFY/cerd1Q0Do8apIo7
+            dO1gz0C2dhh6QvGAovH7k0fS+bH3N1qpqbzmLQfMArXytQVZg1Ucisk9VYkS9XEE
+            dV0TVTOOEyq8rOzmZHfhVqGv+VsAMQXdcgsCRJ8HDLDWlDAOnuIX86NvlNmDHuZu
+            9jMqCq+cmf7W0sZdamHLM/T3IXs0oJJc4YvyFAlPTPdbGHICQ1rWDLXvICIXiifg
+            LzkbK0XjxG+fDCzKzMXJ/gho7KHOut/+Kf5+hQNMnoPZ3/MeDJEyAHKBEsTI/CYe
+            9qla0CJnUVNRHDnc99qMeSeD7p6OLZsO4cANTSEnz0eiyZoJKa2m8du1TTtxIzCt
+            Jcu1yFana7MX68ppxlqkfd7iSPyGo9d7DcPO9lFscNQ9yIPiGReZ8Ow7KSlu37LS
+            VgFsGneFVfYYk6SnW9SOtooNAFNL9sWxqiWjb3fxfGeIuOF7LJqmevx7SU8V5eAt
+            nCqGZZg/YCAecjTDHi8Yy5ly2LrNjF6yOhUtYifW6yBJB2UEQdDE
+            =mUhm
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

machines/ns1/secrets.yaml

@@ -0,0 +1,55 @@
+wg_private: ENC[AES256_GCM,data:KjuXpIBnp/LVjOvaSk0vZEF3vOcq0y7cnEohYMFAHnnJK+TiGt3+ESkF08c=,iv:zlWkp9blv2KmIpXEOQRqle2voHIS/EhTVuWKJQ/qowY=,tag:nOUDEcwKODx8G8p7jWPA2w==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBadURpbnpJWVl0cG5PMWlt
+            dUFGTWp0Q0Naamh0NmI1bTdDc2JGVjYrZmcwCmc4aXU4SHpmMlZtUklhODl2eDBj
+            THErS0JubEFxQlhxdVBOVGNuanNCUE0KLS0tIFpwU0NqRU9DRTc2dnhpQ3J4S2Yr
+            MXpoUHpEcng0TWNGVEphNEliMitJUEUK4nkg0jviVZR6As/xdWBysJyQuU2uDzgC
+            Zsq1QVSdb7EZPcxb12Xb6GvazsKZGxztn5jgzaGDb1HjA2UgIo8lgQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+    lastmodified: "2026-09-10T15:02:04Z"
+    mac: ENC[AES256_GCM,data:Ykr0571wJjFij/4j6aIBXVOpkyU6jCbAdnjvxLQfwrxB25CgqaposamrFJVWMKXTHhjD9cyERuApAglIcDmgfDAE7udeE5UaQDTPzTgxSteDwr8t1Ln7D5nQ2euPZXqSEdEUYTvQZSufr47x1jHBdgpcsm2xjBQijRh5UtsuCzc=,iv:H3PuuKbdEoEq2Xrw1NuYEZty99MHCcHRZHAhRFgmrYw=,tag:s4vBcEvL4A39PLNInXknvg==,type:str]
+    pgp:
+        - created_at: "2026-09-10T15:01:43Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQv9HboIa8736BJypvKq+kj4wIoqAC4cihodE1xbF5lVrN7l
+            pYXGmAH9fbfK2vTz2kdiBhcFOMgIJ2VEzefDwxtOG+vp+YMHPnFJwsj/D1iwPPoj
+            TPUWLhRXVw5HO1bNBqHoOZJPoZszdRQxkQ4OoiBRO5G+o8f3hIUjriyVym7N+Eu3
+            IGzMU8/RBqJKIqft+jnp3uEZqXGWwALisyFZiQmjZqifaGo3YwOGMGHcjvs3bZws
+            jSkvMHLoJQuwBeWmIJ9mCnI0AQ4kLsLqmgtuJGxWW/I+1kZ9lY//STkzxBzTESwd
+            IOdlP0LWybzSia52A7OLgpYZuLLD+lDvunzN/gqm9YKJcwTxTHnp2wLmoJU6KyL1
+            KnXyLWuQi5xaPXjVvhVYWjkqZr+1/nGMDSZJRxdCSvipCkJF2L62pzqmuz731AA+
+            cMyoPXGTH/fz4P1c/hRQNG7tGax6IgSJMuU3OZxm22ZDAfQbVKIDk35WxP7qotbI
+            IgDqArGJ1qEhFj+OAvUn0lYBxmbDTEFkjjOGhl0YoDQhxbtLasYykdC0pkAOQbN9
+            Mclk2TXYXbr6mdB2uzrtSTojV76birSH29F7Fp+D+EShA4hbZix41Y2oEZBWGZd5
+            Po3yVsfOvQ==
+            =wSya
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-09-10T15:01:43Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ/9ECDAkME8/ey+CfxVm3DynkSzy0nLAXVaR1cT3FPoxM/O
+            XJK1gDooVdd/zqvLCRAHIpOdRYcqifnfTRUg7RQo4wo5u6XNnWstf5Qh3ECSunkP
+            s8axVBrYKTwUN2fa7Kil57wSARGIyguufkW5l/Ur5pAJPAEG+q156o/vNNG99XQ9
+            PMffjfBV5Hdm2jljsUndz/Y8Qo3ES412AtpokjiK/6r/JLM7s0yNktyApiOqg2Co
+            RiMKrxTaBucRXMy9IZgqNetc5Syg/y7ZWhtnSvznGN3o6lWq7aqi8PsEzpkb7DyO
+            hhOs5KSvR1+LomOHQvNaSgwKgy8IfMQAde5U0thcavYLvmxXnuN3z3u9mBF1WHqm
+            6laktFM5u9FMLuQUrlYnU9LXakD5ycVEnxEf3+BHRkabatv/OkT+NzocCbydFBEP
+            zuenjVUxb+tJWb/GDIXj8sa6/VCNPwZ04DR6TLRgY9CLSBZ1WtqNjOCi47NL9we/
+            If5/JtBf0B9nWsVNc0XaVqKxHcOLAg6rdnhYl9+QUZtQfVjZXFNGQQhCFhVOCnD9
+            h7vNysHZeOpVT2kV28DhmpO5t5IBTPAhiflGlQJT9UYaLQQf4TroxI/YGFa34qsc
+            Ot8KxvVyw0FtALa/AitdQc7DKv9LBLHVPeJXwOZvzni55Uj8dDs54aHIvqLYA9nS
+            VgFL5a9vroRpmtWYK6laLfhIViYr163GEBIPKlyeN3Ze+Djw8mbf++K7gHrF1KF/
+            7Ycgco/LP3/jrJVrcLxkVRbS4ICIJkg9JvhqAcEjDuE2nUn+orag
+            =qHPq
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1