From 02ace17fd8e3eeb29b493eb756569ba53639d0e9 Mon Sep 17 00:00:00 2001 From: kalipso Date: Thu, 10 Sep 2026 17:03:14 +0200 Subject: [PATCH 1/2] [ns1] deploy on fanny --- machines/.sops.yaml | 8 ++++ machines/fanny/configuration.nix | 1 + machines/modules/malobeo/peers.nix | 7 +++ machines/modules/malobeo/wireguard.nix | 1 + machines/ns1/dummy.yaml | 64 ++++++++++++++++++++++++++ machines/ns1/secrets.yaml | 55 ++++++++++++++++++++++ 6 files changed, 136 insertions(+) create mode 100644 machines/ns1/dummy.yaml create mode 100644 machines/ns1/secrets.yaml diff --git a/machines/.sops.yaml b/machines/.sops.yaml index 876b279..10091bd 100644 --- a/machines/.sops.yaml +++ b/machines/.sops.yaml @@ -17,6 +17,7 @@ keys: - &machine_vaultwarden age1zs9puemeevc5kt84w9d2mc5396w0t9p60qxymkpatwvwxunzs5usmxr3an - &machine_pretalx age1y04q8n7mgk82c87rfddm0u72h0ny6sfzktjsk0cc3gu93kezudfqdp9v9g - &machine_albert age1mfarz0n7qfa7vg8zz355qf8eregm6myl38lld0h767nuvhgjqd4qruxuhn + - &machine_ns1 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA #this dummy key is used for testing. - &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng creation_rules: @@ -123,6 +124,13 @@ creation_rules: age: - *admin_atlan - *machine_albert + - path_regex: ns1/secrets.yaml$ + key_groups: + - pgp: + - *admin_kalipso + - *admin_kalipso_dsktp + age: + - *admin_atlan - path_regex: .*/secrets/.* key_groups: - pgp: diff --git a/machines/fanny/configuration.nix b/machines/fanny/configuration.nix index 87b2823..4d6b5c6 100644 --- a/machines/fanny/configuration.nix +++ b/machines/fanny/configuration.nix @@ -147,6 +147,7 @@ in "vaultwarden" "pretalx" "antamap" + "ns1" ]; networking = { diff --git a/machines/modules/malobeo/peers.nix b/machines/modules/malobeo/peers.nix index 876b7a3..314fb84 100644 --- a/machines/modules/malobeo/peers.nix +++ b/machines/modules/malobeo/peers.nix @@ -65,4 +65,11 @@ allowedIPs = [ "10.100.0.20/32" ]; publicKey = "Pp55Jg//jREzHdbbIqTXc9N7rnLZIFw904qh6NLrACE="; }; + + "ns1" = { + role = "client"; + address = "10.100.0.21"; + allowedIPs = [ "10.100.0.21/32" ]; + publicKey = "jozMsP5MA2uz7eOrXG8LB8mr2tHVa6FL1+tbMQs9ySk="; + }; } diff --git a/machines/modules/malobeo/wireguard.nix b/machines/modules/malobeo/wireguard.nix index 6c5a320..f42e22d 100644 --- a/machines/modules/malobeo/wireguard.nix +++ b/machines/modules/malobeo/wireguard.nix @@ -72,6 +72,7 @@ in mtu = 1340; #seems to be necessary to proxypass nginx traffic through vpn address = [ "${myPeer.address}/24" ]; autostart = cfg.autostart; + dns = peers.ns1.address; listenPort = mkIf (myPeer.role == "server") myPeer.listenPort; # This allows the wireguard server to route your traffic to the internet and hence be like a VPN diff --git a/machines/ns1/dummy.yaml b/machines/ns1/dummy.yaml new file mode 100644 index 0000000..b291622 --- /dev/null +++ b/machines/ns1/dummy.yaml @@ -0,0 +1,64 @@ +wg_private: ENC[AES256_GCM,data:KnlCYE1/WjhNLfazuKViiVKZLPqQHwwqX1o2Irxaoj6oa54s6vBoiHVste4=,iv:ZAqdUSGwzbrLjskAntzmcNCcIjyePG+awYRkSgi6tZg=,tag:vllLI+0dbuFlkcdaYsBqYQ==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBSDdNMUxFRGROR2YwN0Vn + SjlqVXV5SmVwOXdWcmgrOUswNnB6YitYeTJvClcrVk53d1FBUndSQWgxRVVySnFl + bVp4R3hHWmtGQW9lWER4L0tmTzdjc00KLS0tIFJRUHlMMGlvOVplTGNGNUo3NWNw + azVxT1hPUUZ4Wmc4QjNGcEtUcDFqd1kKZU2LEJsStdOspRE1CmbXevkQDfPHTuWp + k4AOM/W2T1Jz70pPl4M+Xg8oCJ5TNaURnvCxuiaBgAtQuZC7OR/Pnw== + -----END AGE ENCRYPTED FILE----- + recipient: age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHMlE1bGVyWkdOOHdja1pM + OUhRU2VCVDhEZ3kxVDRzb0Z4YUxOeFZFTVdJCjlWd2NlUmcwU3dQb1pMT2U0a1ZO + Zk5HNVJtQWREMWpXVG9ZVkd2QkVjeVkKLS0tIHBXbDUrcjl5VXNXT3JPTThIYVFa + TEtTb1pNUjVUM3dBVFRJMUpnNng2bEkKBfxqOkJ4R4RMl4AYMmFXq0dYeiH8UuwB + 1ozr78TT5ksdRHuYmOyJzAG3Q14tK/+h1tcSmh5bXIZtuzJzZKN4kw== + -----END AGE ENCRYPTED FILE----- + recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c + lastmodified: "2026-09-10T15:02:33Z" + mac: ENC[AES256_GCM,data:e03qvt+6PI5FsKtV4aK1XhX1RCzzsvAf42/NOau5kEa0pRaSM+ajTJSD+06oC35gBYwB3w9Hq1ubFZVvZM3vgqITSNzCNJr7ft6LI48Srq0VjtKoGmjKqETYTTSNhbisNCI+sU13pdV18BESHE5eIGY/0KHcSeF1vG7Ys2DMTwM=,iv:cmfCkTMj5+NxWgBIthg2MaG39CYOsZdqTOMszOiOmY0=,tag:a4ooDhkCtLZm/s1O0tNGug==,type:str] + pgp: + - created_at: "2026-09-10T15:02:19Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQGMA5HdvEwzh/H7AQv/Wz+3/F+/IPsaVUZbJ6GB8V5HkowP7KCzWJOxwY3B3Yhl + H4Qir6G6aT2CpD5hHy+zEFw7s5t+MILybyzMZqNocjuQWIrF/YIYUbTDKK6rgSzC + tx0E6DcndBf69eK2wL8Um19/boB+MTN3DQSUom6Jpvg7WGo0NjtDexAqwSpJwFFF + di2DoUDHyTUUdHTcD+hfODTiQYC7cp51hZ6n3JACu1toGNfre1A/PtoSOTYP9i2p + aIIWBSciT4K1RJnIhV4fpU7wh7gi0O4xS1XZnTQ/SOA26sHp8wObLvi3TwF5AKum + dYyuCinJGMep7VBjBf7eJ73TI4CD1QM+MEQTzegPVlo54LvqSqwp8ZwHdIZi9gQ4 + 3Vku2hGSOI9SmOjOR5GGEYfJS3BbbF9rJCnamBhZVVO5lXbFtZqWi0JOu8U4Esnw + DTzLDOJpajEo7YxADD7yyLlFXDRtMNgU91hCjBLz76SgExI3avWq3Mm+KZXI4xCt + L0yENHriidkFR2T/uV4w0lYBAPOSvPnvxK92VEa1oDrhIjcFd0JwH/XsrYq/nih6 + 4PBf4U5DdO+ulJOj6MXV0QmsZXMObX8LWh6myufRTPIPl6wA5SeSvleDuiWQKYdW + j0rqALTicw== + =mpXh + -----END PGP MESSAGE----- + fp: c4639370c41133a738f643a591ddbc4c3387f1fb + - created_at: "2026-09-10T15:02:19Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA98TrrsQEbXUAQ/9EqodWqh61g7Uv1L/oF8PMMsONmprOg+17Xvn33xI8Pam + SjiEaGh8qZRJckFPdWgw1QNfpzFnEjpJEYMQ46oHJxlLMd5T4eqOTHbmPC3IAktm + lg3yYRmHEhyrngmQPTnoKuNQg6YDhzorHsfD98Tf0zA0B9AGCukgDZoEUs2oXwsY + PiZYcTcgB8z/8petU9YlieO7frm17Srso5JfOfIlu88vtlAeu3z8LZl5iKl34Lxz + +2TGAz/6YTYx24Tmj9qWpRYYPpbnQNUTkm+D9eDts6Pz1SFY/cerd1Q0Do8apIo7 + dO1gz0C2dhh6QvGAovH7k0fS+bH3N1qpqbzmLQfMArXytQVZg1Ucisk9VYkS9XEE + dV0TVTOOEyq8rOzmZHfhVqGv+VsAMQXdcgsCRJ8HDLDWlDAOnuIX86NvlNmDHuZu + 9jMqCq+cmf7W0sZdamHLM/T3IXs0oJJc4YvyFAlPTPdbGHICQ1rWDLXvICIXiifg + LzkbK0XjxG+fDCzKzMXJ/gho7KHOut/+Kf5+hQNMnoPZ3/MeDJEyAHKBEsTI/CYe + 9qla0CJnUVNRHDnc99qMeSeD7p6OLZsO4cANTSEnz0eiyZoJKa2m8du1TTtxIzCt + Jcu1yFana7MX68ppxlqkfd7iSPyGo9d7DcPO9lFscNQ9yIPiGReZ8Ow7KSlu37LS + VgFsGneFVfYYk6SnW9SOtooNAFNL9sWxqiWjb3fxfGeIuOF7LJqmevx7SU8V5eAt + nCqGZZg/YCAecjTDHi8Yy5ly2LrNjF6yOhUtYifW6yBJB2UEQdDE + =mUhm + -----END PGP MESSAGE----- + fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4 + unencrypted_suffix: _unencrypted + version: 3.13.1 diff --git a/machines/ns1/secrets.yaml b/machines/ns1/secrets.yaml new file mode 100644 index 0000000..73b3913 --- /dev/null +++ b/machines/ns1/secrets.yaml @@ -0,0 +1,55 @@ +wg_private: ENC[AES256_GCM,data:KjuXpIBnp/LVjOvaSk0vZEF3vOcq0y7cnEohYMFAHnnJK+TiGt3+ESkF08c=,iv:zlWkp9blv2KmIpXEOQRqle2voHIS/EhTVuWKJQ/qowY=,tag:nOUDEcwKODx8G8p7jWPA2w==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBadURpbnpJWVl0cG5PMWlt + dUFGTWp0Q0Naamh0NmI1bTdDc2JGVjYrZmcwCmc4aXU4SHpmMlZtUklhODl2eDBj + THErS0JubEFxQlhxdVBOVGNuanNCUE0KLS0tIFpwU0NqRU9DRTc2dnhpQ3J4S2Yr + MXpoUHpEcng0TWNGVEphNEliMitJUEUK4nkg0jviVZR6As/xdWBysJyQuU2uDzgC + Zsq1QVSdb7EZPcxb12Xb6GvazsKZGxztn5jgzaGDb1HjA2UgIo8lgQ== + -----END AGE ENCRYPTED FILE----- + recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c + lastmodified: "2026-09-10T15:02:04Z" + mac: ENC[AES256_GCM,data:Ykr0571wJjFij/4j6aIBXVOpkyU6jCbAdnjvxLQfwrxB25CgqaposamrFJVWMKXTHhjD9cyERuApAglIcDmgfDAE7udeE5UaQDTPzTgxSteDwr8t1Ln7D5nQ2euPZXqSEdEUYTvQZSufr47x1jHBdgpcsm2xjBQijRh5UtsuCzc=,iv:H3PuuKbdEoEq2Xrw1NuYEZty99MHCcHRZHAhRFgmrYw=,tag:s4vBcEvL4A39PLNInXknvg==,type:str] + pgp: + - created_at: "2026-09-10T15:01:43Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQGMA5HdvEwzh/H7AQv9HboIa8736BJypvKq+kj4wIoqAC4cihodE1xbF5lVrN7l + pYXGmAH9fbfK2vTz2kdiBhcFOMgIJ2VEzefDwxtOG+vp+YMHPnFJwsj/D1iwPPoj + TPUWLhRXVw5HO1bNBqHoOZJPoZszdRQxkQ4OoiBRO5G+o8f3hIUjriyVym7N+Eu3 + IGzMU8/RBqJKIqft+jnp3uEZqXGWwALisyFZiQmjZqifaGo3YwOGMGHcjvs3bZws + jSkvMHLoJQuwBeWmIJ9mCnI0AQ4kLsLqmgtuJGxWW/I+1kZ9lY//STkzxBzTESwd + IOdlP0LWybzSia52A7OLgpYZuLLD+lDvunzN/gqm9YKJcwTxTHnp2wLmoJU6KyL1 + KnXyLWuQi5xaPXjVvhVYWjkqZr+1/nGMDSZJRxdCSvipCkJF2L62pzqmuz731AA+ + cMyoPXGTH/fz4P1c/hRQNG7tGax6IgSJMuU3OZxm22ZDAfQbVKIDk35WxP7qotbI + IgDqArGJ1qEhFj+OAvUn0lYBxmbDTEFkjjOGhl0YoDQhxbtLasYykdC0pkAOQbN9 + Mclk2TXYXbr6mdB2uzrtSTojV76birSH29F7Fp+D+EShA4hbZix41Y2oEZBWGZd5 + Po3yVsfOvQ== + =wSya + -----END PGP MESSAGE----- + fp: c4639370c41133a738f643a591ddbc4c3387f1fb + - created_at: "2026-09-10T15:01:43Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA98TrrsQEbXUAQ/9ECDAkME8/ey+CfxVm3DynkSzy0nLAXVaR1cT3FPoxM/O + XJK1gDooVdd/zqvLCRAHIpOdRYcqifnfTRUg7RQo4wo5u6XNnWstf5Qh3ECSunkP + s8axVBrYKTwUN2fa7Kil57wSARGIyguufkW5l/Ur5pAJPAEG+q156o/vNNG99XQ9 + PMffjfBV5Hdm2jljsUndz/Y8Qo3ES412AtpokjiK/6r/JLM7s0yNktyApiOqg2Co + RiMKrxTaBucRXMy9IZgqNetc5Syg/y7ZWhtnSvznGN3o6lWq7aqi8PsEzpkb7DyO + hhOs5KSvR1+LomOHQvNaSgwKgy8IfMQAde5U0thcavYLvmxXnuN3z3u9mBF1WHqm + 6laktFM5u9FMLuQUrlYnU9LXakD5ycVEnxEf3+BHRkabatv/OkT+NzocCbydFBEP + zuenjVUxb+tJWb/GDIXj8sa6/VCNPwZ04DR6TLRgY9CLSBZ1WtqNjOCi47NL9we/ + If5/JtBf0B9nWsVNc0XaVqKxHcOLAg6rdnhYl9+QUZtQfVjZXFNGQQhCFhVOCnD9 + h7vNysHZeOpVT2kV28DhmpO5t5IBTPAhiflGlQJT9UYaLQQf4TroxI/YGFa34qsc + Ot8KxvVyw0FtALa/AitdQc7DKv9LBLHVPeJXwOZvzni55Uj8dDs54aHIvqLYA9nS + VgFL5a9vroRpmtWYK6laLfhIViYr163GEBIPKlyeN3Ze+Djw8mbf++K7gHrF1KF/ + 7Ycgco/LP3/jrJVrcLxkVRbS4ICIJkg9JvhqAcEjDuE2nUn+orag + =qHPq + -----END PGP MESSAGE----- + fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4 + unencrypted_suffix: _unencrypted + version: 3.13.1 -- 2.54.0 From d55ae159500b030fcc8cacbde3414667097c64c5 Mon Sep 17 00:00:00 2001 From: Ahtlon Date: Fri, 11 Sep 2026 09:04:56 +0200 Subject: [PATCH 2/2] [ns1] fix str->list.str --- machines/modules/malobeo/wireguard.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/machines/modules/malobeo/wireguard.nix b/machines/modules/malobeo/wireguard.nix index f42e22d..fcb040a 100644 --- a/machines/modules/malobeo/wireguard.nix +++ b/machines/modules/malobeo/wireguard.nix @@ -72,7 +72,7 @@ in mtu = 1340; #seems to be necessary to proxypass nginx traffic through vpn address = [ "${myPeer.address}/24" ]; autostart = cfg.autostart; - dns = peers.ns1.address; + dns = [peers.ns1.address]; listenPort = mkIf (myPeer.role == "server") myPeer.listenPort; # This allows the wireguard server to route your traffic to the internet and hence be like a VPN -- 2.54.0