diff --git a/nixos/agares/configuration.nix b/nixos/agares/configuration.nix index 099d65d..c28a4f8 100644 --- a/nixos/agares/configuration.nix +++ b/nixos/agares/configuration.nix @@ -1,18 +1,45 @@ { config -, pkgs , lib +, modulesPath +, pkgs , ... -}: { +}: +{ imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + ./ddns.nix + ./dns.nix + ./firewall.nix ../modules/profiles/server.nix - ./hardware-configuration.nix + ./network.nix + ./ntp.nix + ./ppp.nix ]; - # to be able to use qemu from substituter - environment.noXlibs = false; + fileSystems."/" = { + device = "/dev/sda1"; + fsType = "btrfs"; + options = [ "subvol=root" ]; + }; - # libvirtd - security.polkit.enable = true; + #fileSystems."/nix/store" = { + # device = "/dev/sda1"; + # fsType = "btrfs"; + # options = [ "subvol=/root/nix" "noatime" ]; + #}; + + fileSystems."/swap" = { + device = "/dev/sda1"; + fsType = "btrfs"; + options = [ "subvol=/root/swap" "noatime" ]; + }; + + #swapDevices = [{ + # device = "/swap/swapfile"; + # size = 32 * 1024; # 32 GByte + #}]; + + hardware.cpu.amd.updateMicrocode = config.hardware.enableRedistributableFirmware; dadada = { admin.enable = true; @@ -23,9 +50,17 @@ networking.hostName = "agares"; networking.domain = "bs.dadada.li"; + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "usb_storage" "sd_mod" "sdhci_pci" ]; + boot.initrd.kernelModules = [ "dm-snapshot" ]; + # Use the GRUB 2 boot loader. boot.loader.grub.enable = true; boot.loader.grub.device = "/dev/sda"; + boot.loader.grub.extraConfig = " + serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1 + terminal_input serial + terminal_output serial + "; boot.kernelParams = [ "console=ttyS0,115200" @@ -41,46 +76,15 @@ "vfio_virqfd" ]; - networking.vlans = { - lan = { - id = 11; - interface = "enp1s0"; - }; - backup = { - id = 13; - interface = "enp1s0"; - }; - }; - - networking.bridges = { - "br-lan" = { - interfaces = [ "lan" ]; - }; - "br-backup" = { - interfaces = [ "backup" ]; - }; - }; - - networking.interfaces.enp1s0.useDHCP = true; - - networking.firewall = { - enable = true; - allowPing = true; - allowedTCPPorts = [ - 22 # SSH - ]; - }; - - virtualisation.libvirtd.enable = true; - environment.systemPackages = with pkgs; [ curl flashrom dmidecode + tcpdump ]; # Running router VM. They have to be restarted in the right order, so network comes up cleanly. Not ideal. system.autoUpgrade.allowReboot = false; - system.stateVersion = "22.05"; + system.stateVersion = "23.05"; } diff --git a/nixos/agares/ddns.nix b/nixos/agares/ddns.nix new file mode 100644 index 0000000..6f47853 --- /dev/null +++ b/nixos/agares/ddns.nix @@ -0,0 +1,13 @@ +{ config, ... }: +{ + dadada.ddns = { + domains = [ "vpn.dadada.li" ]; + credentialsPath = config.age.secrets."ddns-credentials".path; + interface = "wan"; + }; + + age.secrets."ddns-credentials" = { + file = "${config.dadada.secrets.path}/ddns-credentials.age"; + mode = "400"; + }; +} diff --git a/nixos/agares/dns.nix b/nixos/agares/dns.nix new file mode 100644 index 0000000..fefcf70 --- /dev/null +++ b/nixos/agares/dns.nix @@ -0,0 +1,69 @@ +{ ... }: +{ + services.unbound = { + enable = true; + localControlSocketPath = "/run/unbound/unbound.ctl"; + settings = { + server = { + access-control = [ + "127.0.0.0/8 allow" + "127.0.0.1/32 allow_snoop" + "192.168.100.0/24 allow" + "192.168.101.0/24 allow" + "192.168.102.0/24 allow" + "192.168.103.0/24 allow" + "192.168.1.0/24 allow" + "172.16.128.0/24 allow" + "::1/128 allow_snoop" + "fd42:9c3b:f96d::/48 allow" + ]; + interface = [ + "127.0.0.1" + "192.168.1.1" + "192.168.100.1" + "192.168.101.1" + "192.168.102.1" + "::1" + "fd42:9c3b:f96d:100::1" + "fd42:9c3b:f96d:101::1" + "fd42:9c3b:f96d:102::1" + "fd42:9c3b:f96d:103::1" + ]; + prefer-ip6 = true; + prefetch = true; + prefetch-key = true; + serve-expired = false; + aggressive-nsec = true; + hide-identity = true; + hide-version = true; + use-caps-for-id = true; + val-permissive-mode = true; + local-zone = [ + "\"168.192.in-addr.arpa.\" nodefault" + "\"d.f.ip6.arpa.\" nodefault" + ]; + }; + forward-zone = [ + { + name = "."; + forward-tls-upstream = "yes"; + forward-addr = [ + "2620:fe::fe@853#dns.quad9.net" + "2620:fe::9@853#dns.quad9.net" + "9.9.9.9@853#dns.quad9.net" + "149.112.112.112@853#dns.quad9.net" + ]; + } + ]; + stub-zone = + let + stubZone = name: addrs: { name = "${name}"; stub-addr = addrs; }; + in + [ + #(stubZone "li.dadada.bs" ["192.168.128.220" "2a01:4f8:c010:a710::1"]) + #(stubZone "d.6.9.f.b.3.c.9.2.4.d.f.ip6.arpa" ["192.168.101.220" "2a01:4f8:c010:a710::1"]) + #(stubZone "168.192.in-addr.arpa" ["192.168.128.220" "2a01:4f8:c010:a710::1"]) + ]; + }; + }; +} diff --git a/nixos/agares/firewall.nix b/nixos/agares/firewall.nix new file mode 100644 index 0000000..569259f --- /dev/null +++ b/nixos/agares/firewall.nix @@ -0,0 +1,13 @@ +{ ... }: +{ + networking = { + useDHCP = false; + nat.enable = false; + firewall.enable = false; + nftables = { + enable = true; + checkRuleset = true; + ruleset = builtins.readFile ./rules.nft; + }; + }; +} diff --git a/nixos/agares/hardware-configuration.nix b/nixos/agares/hardware-configuration.nix deleted file mode 100644 index fdd49d2..0000000 --- a/nixos/agares/hardware-configuration.nix +++ /dev/null @@ -1,35 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ config -, lib -, pkgs -, modulesPath -, ... -}: { - imports = [ - (modulesPath + "/installer/scan/not-detected.nix") - ]; - - boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "usb_storage" "sd_mod" "sdhci_pci" ]; - boot.initrd.kernelModules = [ ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = { - device = "/dev/sda1"; - fsType = "btrfs"; - options = [ "subvol=root" ]; - }; - - swapDevices = [ ]; - - # The global useDHCP flag is deprecated, therefore explicitly set to false here. - # Per-interface useDHCP will be mandatory in the future, so this generated config - # replicates the default behaviour. - networking.useDHCP = lib.mkDefault false; - networking.interfaces.enp1s0.useDHCP = lib.mkDefault true; - networking.interfaces.enp2s0.useDHCP = lib.mkDefault true; - networking.interfaces.enp3s0.useDHCP = lib.mkDefault true; - - hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; -} diff --git a/nixos/agares/network.nix b/nixos/agares/network.nix new file mode 100644 index 0000000..b51dfae --- /dev/null +++ b/nixos/agares/network.nix @@ -0,0 +1,252 @@ +{ config, lib, ... }: +let + mergeAttrsList = lib.attrsets.mergeAttrsList; + map = builtins.map; + ulaPrefix = "fd42:9c3b:f96d"; # fd42:9c3b:f96d::/48 + ipv4Prefix = "192.168"; # 192.168.96.0/19 + domain = "bs.dadada.li"; +in +{ + systemd.network = { + enable = true; + links = { + "10-persistent" = { + matchConfig.OriginalName = [ "enp1s0" "enp2s0" ]; + linkConfig.MACAddressPolicy = "persistent"; + }; + }; + netdevs = { + # QoS concentrator + "ifb4ppp0" = { + netdevConfig = { + Kind = "ifb"; + Name = "ifb4ppp0"; + }; + }; + "20-lan" = { + netdevConfig = { + Kind = "vlan"; + Name = "lan.10"; + }; + vlanConfig = { + Id = 10; + }; + }; + "20-freifunk" = { + netdevConfig = { + Kind = "vlan"; + Name = "ff.11"; + }; + vlanConfig = { + Id = 11; + }; + }; + "20-srv" = { + netdevConfig = { + Kind = "vlan"; + Name = "srv.13"; + }; + vlanConfig = { + Id = 13; + }; + }; + "20-roadw" = { + netdevConfig = { + Kind = "wireguard"; + Name = "roadw"; + }; + wireguardConfig = { + PrivateKeyFile = config.age.secrets."wg-privkey-vpn-dadada-li".path; + ListenPort = 51234; + }; + wireguardPeers = [{ + wireguardPeerConfig = + let + peerAddresses = i: [ + "${ipv4Prefix}.120.${i}/32" + "${ulaPrefix}:120::${i}/128" + ]; + in + { + PublicKey = "0eWP1hzkyoXlrjPSOq+6Y1u8tnFH+SejBJs8f8lf+iU="; + AllowedIPs = peerAddresses "3"; + }; + }]; + }; + }; + networks = let + subnet = name: subnetId: { + matchConfig.Name = name; + addresses = [ + { addressConfig.Address = "${ipv4Prefix}.${subnetId}.1/24"; } + { addressConfig.Address = "${ulaPrefix}:${subnetId}::1/64"; } + ]; + dhcpPrefixDelegationConfig = { + SubnetId = "0x${subnetId}"; + }; + ipv6Prefixes = [ + { + ipv6PrefixConfig.Prefix = "${ulaPrefix}:${subnetId}::/64"; + } + ]; + dhcpServerConfig = { + DNS = "${ipv4Prefix}.${subnetId}.1"; + NTP = "${ipv4Prefix}.${subnetId}.1"; + EmitDNS = true; + EmitNTP = true; + EmitRouter = true; + PoolOffset = 100; + PoolSize = 100; + SendOption = "12:string:${domain}"; + }; + linkConfig = { + RequiredForOnline = "no"; + }; + networkConfig = { + Domains = domain; + EmitLLDP = "yes"; + IPv6SendRA = true; + IPv6AcceptRA = false; + DHCPPrefixDelegation = true; + DHCPServer = true; + }; + extraConfig = '' + [CAKE] + OverheadBytes = 38 + Bandwidth = 1G + ''; + }; + in { + "10-mgmt" = subnet "enp1s0" "100" // { + networkConfig.VLAN = [ "lan.10" "ff.11" "srv.13" ]; + dhcpServerStaticLeases = [ + { + # legion + dhcpServerStaticLeaseConfig = { + Address = "192.168.100.107"; + MACAddress = "80:CC:9C:95:4A:60"; + }; + } + ]; + }; + "30-lan" = subnet "lan.10" "101" // { + dhcpServerStaticLeases = [ + { + # ninurta + dhcpServerStaticLeaseConfig = { + Address = "192.168.101.184"; + MACAddress = "48:21:0B:3E:9C:FE"; + }; + } + { + # crocell + dhcpServerStaticLeaseConfig = { + Address = "192.168.101.122"; + MACAddress = "9C:C9:EB:4F:3F:0E"; + }; + } + { + # gorgon + dhcpServerStaticLeaseConfig = { + Address = "192.168.101.205"; + MACAddress = "8C:C6:81:6A:39:2F"; + }; + } + ]; + }; + + "30-ff" = subnet "ff.11" "102"; + + "30-srv" = subnet "srv.13" "103"; + + "30-ifb4ppp0" = { + name = "ifb4ppp0"; + extraConfig = '' + [CAKE] + OverheadBytes = 65 + Bandwidth = 95M + FlowIsolationMode = triple + ''; + }; + + # TODO does not work + "30-ppp0" = { + name = "ppp*"; + linkConfig = { + RequiredForOnline = "routable"; + }; + networkConfig = { + KeepConfiguration = "static"; + DefaultRouteOnDevice = true; + LinkLocalAddressing = "ipv6"; + DHCP = "ipv6"; + }; + extraConfig = '' + [CAKE] + OverheadBytes = 65 + Bandwidth = 36M + FlowIsolationMode = triple + [DHCPv6] + PrefixDelegationHint= ::/56 + UseAddress = false + UseDelegatedPrefix = true + WithoutRA = solicit + [DHCPPrefixDelegation] + UplinkInterface=:self + ''; + ipv6SendRAConfig = { + # Let networkd know that we would very much like to use DHCPv6 + # to obtain the "managed" information. Not sure why they can't + # just take that from the upstream RAs. + Managed = true; + }; + }; + # Talk to modem for management + "enp2s0" = { + name = "enp2s0"; + linkConfig = { + RequiredForOnline = "no"; + }; + networkConfig = { + Address = "192.168.1.254/24"; + EmitLLDP = "yes"; + }; + }; + "10-roadw" = { + matchConfig.Name = "roadw"; + address = [ + "${ipv4Prefix}.120.1/32" + "${ulaPrefix}:120::1/128" + ]; + DHCP = "no"; + networkConfig.IPv6AcceptRA = false; + linkConfig.RequiredForOnline = "no"; + routes = [ + { + routeConfig = { Destination = "${ipv4Prefix}.120.1/24"; }; + } + { + routeConfig = { Destination = "${ulaPrefix}::120:1/64"; }; + } + ]; + }; + }; + }; + + age.secrets."wg-privkey-vpn-dadada-li" = { + file = "${config.dadada.secrets.path}/wg-privkey-vpn-dadada-li.age"; + owner = "systemd-network"; + }; + + boot.kernel.sysctl = { + # Enable forwarding for interface + "net.ipv4.conf.all.forwarding" = "1"; + "net.ipv6.conf.all.forwarding" = "1"; + "net.ipv6.conf.all.accept_ra" = "0"; + "net.ipv6.conf.all.autoconf" = "0"; + # Set via systemd-networkd + #"net.ipv6.conf.${intf}.use_tempaddr" = "0"; + }; + + powerManagement.cpuFreqGovernor = lib.mkDefault "schedutil"; +} diff --git a/nixos/agares/ntp.nix b/nixos/agares/ntp.nix new file mode 100644 index 0000000..c3ec49b --- /dev/null +++ b/nixos/agares/ntp.nix @@ -0,0 +1,12 @@ +{ ... }: +{ + services.chrony = { + enable = true; + extraConfig = '' + allow 192.168.1 + allow 192.168.100 + allow 192.168.101 + allow 192.168.102 + ''; + }; +} diff --git a/nixos/agares/ppp.nix b/nixos/agares/ppp.nix new file mode 100644 index 0000000..dc26e46 --- /dev/null +++ b/nixos/agares/ppp.nix @@ -0,0 +1,63 @@ +{ pkgs, lib, config, ... }: +let + secretsPath = config.dadada.secrets.path; +in +{ + # PPPoE + services.pppd = { + enable = true; + peers = { + telekom = { + enable = true; + autostart = true; + config = '' + debug + + plugin pppoe.so enp2s0 + + noauth + hide-password + call telekom-secret + + linkname ppp0 + + persist + maxfail 0 + holdoff 5 + + noipdefault + defaultroute + + lcp-echo-interval 15 + lcp-echo-failure 3 + ''; + }; + }; + }; + + age.secrets."etc-ppp-telekom-secret" = { + file = "${secretsPath}/etc-ppp-telekom-secret.age"; + owner = "root"; + mode = "700"; + path = "/etc/ppp/peers/telekom-secret"; + }; + + age.secrets."etc-ppp-pap-secrets" = { + # format: client server passphrase + file = "${secretsPath}/etc-ppp-chap-secrets.age"; + owner = "root"; + mode = "700"; + path = "/etc/ppp/pap-secrets"; + }; + + # Hook for QoS via Intermediate Functional Block + environment.etc."ppp/ip-up" = { + mode = "755"; + text = with lib; '' + #!/usr/bin/env sh + ${getBin pkgs.iproute2}/bin/tc qdisc del dev $1 ingress + ${getBin pkgs.iproute2}/bin/tc qdisc add dev $1 handle ffff: ingress + ${getBin pkgs.iproute2}/bin/tc filter add dev $1 parent ffff: matchall action mirred egress redirect dev ifb4ppp0 + ''; + }; +} diff --git a/nixos/agares/rules.nft b/nixos/agares/rules.nft new file mode 100644 index 0000000..733ef57 --- /dev/null +++ b/nixos/agares/rules.nft @@ -0,0 +1,140 @@ +flush ruleset + +define IF_MGMT = "enp1s0" +define IF_FF = "ff.11" +define IF_LAN = "lan.10" +define IF_WAN = "ppp0" +define IF_SRV = "srv.13" + +# Modem uses this for internet uplink via our WAN +define IF_MODEM = "enp2s0" + +define IF_ROADW = "roadwarrior" + +table inet filter { + # Will give "no such file or directory if hardware does not support flow offloading" + # flowtable f { + # hook ingress priority 0; devices = { enp1s0, enp2s0 }; flags offload; + # } + + chain input_local { + ip6 saddr != ::1/128 log prefix "Dropped IPv6 nonlocalhost packet on loopback:" drop + accept comment "Accept traffic to loopback interface" + } + + chain input_icmp_untrusted { + # Allow ICMP echo + ip protocol icmp icmp type { echo-request } limit rate 1000/second burst 5 packets accept comment "Accept echo request" + + # Allow some ICMPv6 + icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, parameter-problem, mld-listener-query, mld-listener-report, mld-listener-done, mld-listener-reduction, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, mld2-listener-report } limit rate 1000/second burst 5 packets accept comment "Allow some ICMPv6" + } + + chain input_modem { + jump input_icmp_untrusted + } + + chain input_wan { + # DHCPv6 client + meta nfproto ipv6 udp sport 547 accept comment "Allow DHCPv6 client" + + jump input_icmp_untrusted + + udp dport 51234 accept comment "Wireguard roadwarriors" + } + + chain input_lan { + counter accept comment "Accept all traffic from LAN" + } + + chain input_mgmt { + counter accept comment "Accept all traffic from MGMT" + } + + chain input_srv { + counter accept comment "Accept all traffic from services" + } + + chain input_roadw { + counter accept comment "Accept all traffic from roadwarriors" + } + + chain input_ff { + jump input_icmp_untrusted + + # DHCP + meta nfproto ipv6 udp dport 547 accept comment "Allow DHCPv6 client" + + # Allow DNS and DHCP from Freifunk + udp dport { 53, 67 } accept comment "Allow DNS and DHCP from Freifunk" + } + + chain input { + type filter hook input priority filter; policy drop; + + ct state {established, related} counter accept comment "Accept packets from established and related connections" + ct state invalid counter drop comment "Early drop of invalid packets" + + iifname vmap { lo : accept, $IF_WAN : jump input_wan, $IF_LAN : jump input_lan, $IF_FF : jump input_ff, $IF_ROADW : jump input_roadw, $IF_MODEM : jump input_modem, $IF_MGMT : jump input_mgmt } + } + +# Only works if hardware flow offloading is available +# chain offload { +# type filter hook forward priority -100; policy accept; +# ip protocol tcp flow add @f +# counter packets 0 bytes 0 +# } + + chain forward { + type filter hook forward priority filter; policy drop; + + # Accept connections tracked by destination NAT + ct status dnat counter accept comment "Accept connections tracked by DNAT" + + # TCP options + tcp flags syn tcp option maxseg size set rt mtu comment "Remove TCP maximum segment size and set a size based on route information" + + # ICMPv6 + icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, parameter-problem } limit rate 5/second counter accept comment "Forward up to five ICMP messages of allowed types per second" + meta l4proto ipv6-icmp accept comment "Forward ICMP in IPv6" + + # mgmt <-> * + iifname { $IF_LAN, $IF_ROADW } oifname $IF_MGMT counter reject comment "Reject traffic from LAN and roadwarrior to MGMT" + iifname $IF_MGMT oifname { $IF_LAN, $IF_ROADW } counter reject comment "Reject traffic from MGMT to LAN and roadwarrior" + # drop (instead of reject) everything else to MGMT + + # LAN, ROADW -> * (except mgmt) + iifname { $IF_LAN, $IF_ROADW } counter accept comment "Allow all traffic forwarding from LAN and roadwarrior to all interfaces, except to mgmt" + + # FF -> WAN + iifname $IF_FF oifname $IF_WAN counter accept comment "Allow all traffic forwarding from Freifunk to WAN" + + # { WAN, SRV } -> { FF, LAN, RW, SRV } + iifname { $IF_WAN, $IF_SRV } oifname { $IF_FF, $IF_LAN, $IF_ROADW, $IF_SRV } ct state established,related counter accept comment "Allow established back from WAN and SRV" + + # WAN -> SRV + iifname $IF_WAN oifname $IF_SRV tcp dport ssh accept comment "Allow all SSH traffic forwarding from WAN to services" + } + + chain output { + type filter hook output priority 100; policy accept; + } +} + +table ip nat { + chain prerouting { + type nat hook prerouting priority dstnat; policy accept; + } + + chain postrouting { + type nat hook postrouting priority srcnat; policy accept; + ip saddr { 192.168.96.0/19 } oifname { $IF_WAN } masquerade comment "Masquerade traffic from LANs" + } +} + +table arp filter { + chain input { + type filter hook input priority filter; policy drop; + iifname { $IF_MGMT, $IF_LAN, $IF_FF, $IF_MODEM } limit rate 1/second burst 2 packets accept comment "Limit number of ARP messages from LAN, FF, MGMT, modem" + } +} diff --git a/secrets/etc-ppp-chap-secrets.age b/secrets/etc-ppp-chap-secrets.age new file mode 100644 index 0000000..8e50189 --- /dev/null +++ b/secrets/etc-ppp-chap-secrets.age @@ -0,0 +1,11 @@ +age-encryption.org/v1 +-> ssh-ed25519 L7f05w xkw7tPnkvX1TGG2/Urocw8mQe6r2/Fpxkvs1Nr3cVXs +eJyvIUrFp0mGWXcmHjP1+5YW9cgs9m8bqUnwgm8iMi0 +-> ssh-ed25519 Otklkw 1IfE9jxV6gz7yfPmSmXsTWsB36RFHmdpjw5eUlElTCo +GyTNhYhDbD2olE6DiKkr47Mu9NMBMHsO5/pTkcx8WXk +-> ~6#g&f-grease +lIbAZllBnOK9YRMIQfPX/veMc111/u5w83pQGuMMWUSyaHT0xwxp8IYn+R9m9iV0 +haQXgTSuQxPhGUJg+1wwncJwnYgzDcCPruprrFTmf0s5HZDr +--- n9uSP8ZmTTZ89mlRiNKtRfAEz7NV7Yn0ZQhzP4uh4fo +#K~lY_!1!fz@ +OFИ(Z!Ȣʟ8aB^!CFP[h$Oafe(l:X*p \ No newline at end of file diff --git a/secrets/etc-ppp-telekom-secret.age b/secrets/etc-ppp-telekom-secret.age new file mode 100644 index 0000000..613016e --- /dev/null +++ b/secrets/etc-ppp-telekom-secret.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> ssh-ed25519 L7f05w HrgIGi6lUHRxv9JkCfrZaEHYlB0uBOhwVrE7FA7fWR0 +YJEklSLR9XWt9Z3Vwjgc9hR7JgcYr7l1lxCCU4TJeOw +-> ssh-ed25519 Otklkw ght72AYlMNBSIdVFjgEmmtNvn0fAfmJSJv6ipacc8XQ +M8qx5eXPdKQo+S1iBGuH3UtOCZxKNpgkMVd5hYaC4/k +-> W)K(iXJ-grease B=`{E +52GLQ+oAwz2AphOjy9U5s9m4rn+YLqauNMvZHQy0l4aEijJr/xdkrgizKs7QpA +--- WG1fXgkKmTl1uge3LGCQFa40X1noXQcMDr21hlhfAu8 +OmU sG m ;<>jIp㘦x[nݕл!n Wn=0ZƜIw- %46 \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 3cdc77b..0328299 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -23,7 +23,10 @@ in "paperless.age".publicKeys = [ systems.gorgon dadada ]; "surgat-ssh_host_ed25519_key.age".publicKeys = [ systems.surgat dadada ]; "ninurta-initrd-ssh-key.age".publicKeys = [ systems.ninurta dadada ]; - "ddns-credentials.age".publicKeys = [ systems.ninurta dadada ]; + "ddns-credentials.age".publicKeys = [ systems.agares systems.ninurta dadada ]; + "etc-ppp-chap-secrets.age".publicKeys = [ systems.agares dadada ]; + "etc-ppp-telekom-secret.age".publicKeys = [ systems.agares dadada ]; + "wg-privkey-vpn-dadada-li.age".publicKeys = [ systems.agares dadada ]; } // backupSecrets "ninurta" // backupSecrets "gorgon" // diff --git a/secrets/wg-privkey-vpn-dadada-li.age b/secrets/wg-privkey-vpn-dadada-li.age new file mode 100644 index 0000000..43f6549 --- /dev/null +++ b/secrets/wg-privkey-vpn-dadada-li.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> ssh-ed25519 L7f05w 626jkdszE7nFjXsB8InmF9c7z0g6Lx45rXviJJVipgk +HOo5D8bIXEUWN+OQOrAtsheqEFpoTEljiQN9iLsGYFw +-> ssh-ed25519 Otklkw MoBeg8zEAs7S8yRN4kMWFmh1wpFG9a3sIl7B3933U0I +KHbNqlQgIfC4oOaXnCHuiXxlmqjwrnR72IdTd18yCVQ +-> ~\AYPd-grease +[i?zA& +k2qPi9GkmpHdaMnPqWsMPWdqa00MdrneQSDEixtbPmedrzPD1w +--- R5nczLpf0MEbOrJBfTOM2mHkh3zbWxZRAn6Ke4PsHSg +[V$q + @<_TYfxM |؝)Uk]93R ] !rĬK \ No newline at end of file