diff --git a/nixos/agares/configuration.nix b/nixos/agares/configuration.nix
index 099d65d..c28a4f8 100644
--- a/nixos/agares/configuration.nix
+++ b/nixos/agares/configuration.nix
@@ -1,18 +1,45 @@
{ config
-, pkgs
, lib
+, modulesPath
+, pkgs
, ...
-}: {
+}:
+{
imports = [
+ (modulesPath + "/installer/scan/not-detected.nix")
+ ./ddns.nix
+ ./dns.nix
+ ./firewall.nix
../modules/profiles/server.nix
- ./hardware-configuration.nix
+ ./network.nix
+ ./ntp.nix
+ ./ppp.nix
];
- # to be able to use qemu from substituter
- environment.noXlibs = false;
+ fileSystems."/" = {
+ device = "/dev/sda1";
+ fsType = "btrfs";
+ options = [ "subvol=root" ];
+ };
- # libvirtd
- security.polkit.enable = true;
+ #fileSystems."/nix/store" = {
+ # device = "/dev/sda1";
+ # fsType = "btrfs";
+ # options = [ "subvol=/root/nix" "noatime" ];
+ #};
+
+ fileSystems."/swap" = {
+ device = "/dev/sda1";
+ fsType = "btrfs";
+ options = [ "subvol=/root/swap" "noatime" ];
+ };
+
+ #swapDevices = [{
+ # device = "/swap/swapfile";
+ # size = 32 * 1024; # 32 GByte
+ #}];
+
+ hardware.cpu.amd.updateMicrocode = config.hardware.enableRedistributableFirmware;
dadada = {
admin.enable = true;
@@ -23,9 +50,17 @@
networking.hostName = "agares";
networking.domain = "bs.dadada.li";
+ boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "usb_storage" "sd_mod" "sdhci_pci" ];
+ boot.initrd.kernelModules = [ "dm-snapshot" ];
+
# Use the GRUB 2 boot loader.
boot.loader.grub.enable = true;
boot.loader.grub.device = "/dev/sda";
+ boot.loader.grub.extraConfig = "
+ serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
+ terminal_input serial
+ terminal_output serial
+ ";
boot.kernelParams = [
"console=ttyS0,115200"
@@ -41,46 +76,15 @@
"vfio_virqfd"
];
- networking.vlans = {
- lan = {
- id = 11;
- interface = "enp1s0";
- };
- backup = {
- id = 13;
- interface = "enp1s0";
- };
- };
-
- networking.bridges = {
- "br-lan" = {
- interfaces = [ "lan" ];
- };
- "br-backup" = {
- interfaces = [ "backup" ];
- };
- };
-
- networking.interfaces.enp1s0.useDHCP = true;
-
- networking.firewall = {
- enable = true;
- allowPing = true;
- allowedTCPPorts = [
- 22 # SSH
- ];
- };
-
- virtualisation.libvirtd.enable = true;
-
environment.systemPackages = with pkgs; [
curl
flashrom
dmidecode
+ tcpdump
];
# Running router VM. They have to be restarted in the right order, so network comes up cleanly. Not ideal.
system.autoUpgrade.allowReboot = false;
- system.stateVersion = "22.05";
+ system.stateVersion = "23.05";
}
diff --git a/nixos/agares/ddns.nix b/nixos/agares/ddns.nix
new file mode 100644
index 0000000..6f47853
--- /dev/null
+++ b/nixos/agares/ddns.nix
@@ -0,0 +1,13 @@
+{ config, ... }:
+{
+ dadada.ddns = {
+ domains = [ "vpn.dadada.li" ];
+ credentialsPath = config.age.secrets."ddns-credentials".path;
+ interface = "wan";
+ };
+
+ age.secrets."ddns-credentials" = {
+ file = "${config.dadada.secrets.path}/ddns-credentials.age";
+ mode = "400";
+ };
+}
diff --git a/nixos/agares/dns.nix b/nixos/agares/dns.nix
new file mode 100644
index 0000000..fefcf70
--- /dev/null
+++ b/nixos/agares/dns.nix
@@ -0,0 +1,69 @@
+{ ... }:
+{
+ services.unbound = {
+ enable = true;
+ localControlSocketPath = "/run/unbound/unbound.ctl";
+ settings = {
+ server = {
+ access-control = [
+ "127.0.0.0/8 allow"
+ "127.0.0.1/32 allow_snoop"
+ "192.168.100.0/24 allow"
+ "192.168.101.0/24 allow"
+ "192.168.102.0/24 allow"
+ "192.168.103.0/24 allow"
+ "192.168.1.0/24 allow"
+ "172.16.128.0/24 allow"
+ "::1/128 allow_snoop"
+ "fd42:9c3b:f96d::/48 allow"
+ ];
+ interface = [
+ "127.0.0.1"
+ "192.168.1.1"
+ "192.168.100.1"
+ "192.168.101.1"
+ "192.168.102.1"
+ "::1"
+ "fd42:9c3b:f96d:100::1"
+ "fd42:9c3b:f96d:101::1"
+ "fd42:9c3b:f96d:102::1"
+ "fd42:9c3b:f96d:103::1"
+ ];
+ prefer-ip6 = true;
+ prefetch = true;
+ prefetch-key = true;
+ serve-expired = false;
+ aggressive-nsec = true;
+ hide-identity = true;
+ hide-version = true;
+ use-caps-for-id = true;
+ val-permissive-mode = true;
+ local-zone = [
+ "\"168.192.in-addr.arpa.\" nodefault"
+ "\"d.f.ip6.arpa.\" nodefault"
+ ];
+ };
+ forward-zone = [
+ {
+ name = ".";
+ forward-tls-upstream = "yes";
+ forward-addr = [
+ "2620:fe::fe@853#dns.quad9.net"
+ "2620:fe::9@853#dns.quad9.net"
+ "9.9.9.9@853#dns.quad9.net"
+ "149.112.112.112@853#dns.quad9.net"
+ ];
+ }
+ ];
+ stub-zone =
+ let
+ stubZone = name: addrs: { name = "${name}"; stub-addr = addrs; };
+ in
+ [
+ #(stubZone "li.dadada.bs" ["192.168.128.220" "2a01:4f8:c010:a710::1"])
+ #(stubZone "d.6.9.f.b.3.c.9.2.4.d.f.ip6.arpa" ["192.168.101.220" "2a01:4f8:c010:a710::1"])
+ #(stubZone "168.192.in-addr.arpa" ["192.168.128.220" "2a01:4f8:c010:a710::1"])
+ ];
+ };
+ };
+}
diff --git a/nixos/agares/firewall.nix b/nixos/agares/firewall.nix
new file mode 100644
index 0000000..569259f
--- /dev/null
+++ b/nixos/agares/firewall.nix
@@ -0,0 +1,13 @@
+{ ... }:
+{
+ networking = {
+ useDHCP = false;
+ nat.enable = false;
+ firewall.enable = false;
+ nftables = {
+ enable = true;
+ checkRuleset = true;
+ ruleset = builtins.readFile ./rules.nft;
+ };
+ };
+}
diff --git a/nixos/agares/hardware-configuration.nix b/nixos/agares/hardware-configuration.nix
deleted file mode 100644
index fdd49d2..0000000
--- a/nixos/agares/hardware-configuration.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-# Do not modify this file! It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations. Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config
-, lib
-, pkgs
-, modulesPath
-, ...
-}: {
- imports = [
- (modulesPath + "/installer/scan/not-detected.nix")
- ];
-
- boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "usb_storage" "sd_mod" "sdhci_pci" ];
- boot.initrd.kernelModules = [ ];
- boot.extraModulePackages = [ ];
-
- fileSystems."/" = {
- device = "/dev/sda1";
- fsType = "btrfs";
- options = [ "subvol=root" ];
- };
-
- swapDevices = [ ];
-
- # The global useDHCP flag is deprecated, therefore explicitly set to false here.
- # Per-interface useDHCP will be mandatory in the future, so this generated config
- # replicates the default behaviour.
- networking.useDHCP = lib.mkDefault false;
- networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
- networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
- networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
-
- hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}
diff --git a/nixos/agares/network.nix b/nixos/agares/network.nix
new file mode 100644
index 0000000..b51dfae
--- /dev/null
+++ b/nixos/agares/network.nix
@@ -0,0 +1,252 @@
+{ config, lib, ... }:
+let
+ mergeAttrsList = lib.attrsets.mergeAttrsList;
+ map = builtins.map;
+ ulaPrefix = "fd42:9c3b:f96d"; # fd42:9c3b:f96d::/48
+ ipv4Prefix = "192.168"; # 192.168.96.0/19
+ domain = "bs.dadada.li";
+in
+{
+ systemd.network = {
+ enable = true;
+ links = {
+ "10-persistent" = {
+ matchConfig.OriginalName = [ "enp1s0" "enp2s0" ];
+ linkConfig.MACAddressPolicy = "persistent";
+ };
+ };
+ netdevs = {
+ # QoS concentrator
+ "ifb4ppp0" = {
+ netdevConfig = {
+ Kind = "ifb";
+ Name = "ifb4ppp0";
+ };
+ };
+ "20-lan" = {
+ netdevConfig = {
+ Kind = "vlan";
+ Name = "lan.10";
+ };
+ vlanConfig = {
+ Id = 10;
+ };
+ };
+ "20-freifunk" = {
+ netdevConfig = {
+ Kind = "vlan";
+ Name = "ff.11";
+ };
+ vlanConfig = {
+ Id = 11;
+ };
+ };
+ "20-srv" = {
+ netdevConfig = {
+ Kind = "vlan";
+ Name = "srv.13";
+ };
+ vlanConfig = {
+ Id = 13;
+ };
+ };
+ "20-roadw" = {
+ netdevConfig = {
+ Kind = "wireguard";
+ Name = "roadw";
+ };
+ wireguardConfig = {
+ PrivateKeyFile = config.age.secrets."wg-privkey-vpn-dadada-li".path;
+ ListenPort = 51234;
+ };
+ wireguardPeers = [{
+ wireguardPeerConfig =
+ let
+ peerAddresses = i: [
+ "${ipv4Prefix}.120.${i}/32"
+ "${ulaPrefix}:120::${i}/128"
+ ];
+ in
+ {
+ PublicKey = "0eWP1hzkyoXlrjPSOq+6Y1u8tnFH+SejBJs8f8lf+iU=";
+ AllowedIPs = peerAddresses "3";
+ };
+ }];
+ };
+ };
+ networks = let
+ subnet = name: subnetId: {
+ matchConfig.Name = name;
+ addresses = [
+ { addressConfig.Address = "${ipv4Prefix}.${subnetId}.1/24"; }
+ { addressConfig.Address = "${ulaPrefix}:${subnetId}::1/64"; }
+ ];
+ dhcpPrefixDelegationConfig = {
+ SubnetId = "0x${subnetId}";
+ };
+ ipv6Prefixes = [
+ {
+ ipv6PrefixConfig.Prefix = "${ulaPrefix}:${subnetId}::/64";
+ }
+ ];
+ dhcpServerConfig = {
+ DNS = "${ipv4Prefix}.${subnetId}.1";
+ NTP = "${ipv4Prefix}.${subnetId}.1";
+ EmitDNS = true;
+ EmitNTP = true;
+ EmitRouter = true;
+ PoolOffset = 100;
+ PoolSize = 100;
+ SendOption = "12:string:${domain}";
+ };
+ linkConfig = {
+ RequiredForOnline = "no";
+ };
+ networkConfig = {
+ Domains = domain;
+ EmitLLDP = "yes";
+ IPv6SendRA = true;
+ IPv6AcceptRA = false;
+ DHCPPrefixDelegation = true;
+ DHCPServer = true;
+ };
+ extraConfig = ''
+ [CAKE]
+ OverheadBytes = 38
+ Bandwidth = 1G
+ '';
+ };
+ in {
+ "10-mgmt" = subnet "enp1s0" "100" // {
+ networkConfig.VLAN = [ "lan.10" "ff.11" "srv.13" ];
+ dhcpServerStaticLeases = [
+ {
+ # legion
+ dhcpServerStaticLeaseConfig = {
+ Address = "192.168.100.107";
+ MACAddress = "80:CC:9C:95:4A:60";
+ };
+ }
+ ];
+ };
+ "30-lan" = subnet "lan.10" "101" // {
+ dhcpServerStaticLeases = [
+ {
+ # ninurta
+ dhcpServerStaticLeaseConfig = {
+ Address = "192.168.101.184";
+ MACAddress = "48:21:0B:3E:9C:FE";
+ };
+ }
+ {
+ # crocell
+ dhcpServerStaticLeaseConfig = {
+ Address = "192.168.101.122";
+ MACAddress = "9C:C9:EB:4F:3F:0E";
+ };
+ }
+ {
+ # gorgon
+ dhcpServerStaticLeaseConfig = {
+ Address = "192.168.101.205";
+ MACAddress = "8C:C6:81:6A:39:2F";
+ };
+ }
+ ];
+ };
+
+ "30-ff" = subnet "ff.11" "102";
+
+ "30-srv" = subnet "srv.13" "103";
+
+ "30-ifb4ppp0" = {
+ name = "ifb4ppp0";
+ extraConfig = ''
+ [CAKE]
+ OverheadBytes = 65
+ Bandwidth = 95M
+ FlowIsolationMode = triple
+ '';
+ };
+
+ # TODO does not work
+ "30-ppp0" = {
+ name = "ppp*";
+ linkConfig = {
+ RequiredForOnline = "routable";
+ };
+ networkConfig = {
+ KeepConfiguration = "static";
+ DefaultRouteOnDevice = true;
+ LinkLocalAddressing = "ipv6";
+ DHCP = "ipv6";
+ };
+ extraConfig = ''
+ [CAKE]
+ OverheadBytes = 65
+ Bandwidth = 36M
+ FlowIsolationMode = triple
+ [DHCPv6]
+ PrefixDelegationHint= ::/56
+ UseAddress = false
+ UseDelegatedPrefix = true
+ WithoutRA = solicit
+ [DHCPPrefixDelegation]
+ UplinkInterface=:self
+ '';
+ ipv6SendRAConfig = {
+ # Let networkd know that we would very much like to use DHCPv6
+ # to obtain the "managed" information. Not sure why they can't
+ # just take that from the upstream RAs.
+ Managed = true;
+ };
+ };
+ # Talk to modem for management
+ "enp2s0" = {
+ name = "enp2s0";
+ linkConfig = {
+ RequiredForOnline = "no";
+ };
+ networkConfig = {
+ Address = "192.168.1.254/24";
+ EmitLLDP = "yes";
+ };
+ };
+ "10-roadw" = {
+ matchConfig.Name = "roadw";
+ address = [
+ "${ipv4Prefix}.120.1/32"
+ "${ulaPrefix}:120::1/128"
+ ];
+ DHCP = "no";
+ networkConfig.IPv6AcceptRA = false;
+ linkConfig.RequiredForOnline = "no";
+ routes = [
+ {
+ routeConfig = { Destination = "${ipv4Prefix}.120.1/24"; };
+ }
+ {
+ routeConfig = { Destination = "${ulaPrefix}::120:1/64"; };
+ }
+ ];
+ };
+ };
+ };
+
+ age.secrets."wg-privkey-vpn-dadada-li" = {
+ file = "${config.dadada.secrets.path}/wg-privkey-vpn-dadada-li.age";
+ owner = "systemd-network";
+ };
+
+ boot.kernel.sysctl = {
+ # Enable forwarding for interface
+ "net.ipv4.conf.all.forwarding" = "1";
+ "net.ipv6.conf.all.forwarding" = "1";
+ "net.ipv6.conf.all.accept_ra" = "0";
+ "net.ipv6.conf.all.autoconf" = "0";
+ # Set via systemd-networkd
+ #"net.ipv6.conf.${intf}.use_tempaddr" = "0";
+ };
+
+ powerManagement.cpuFreqGovernor = lib.mkDefault "schedutil";
+}
diff --git a/nixos/agares/ntp.nix b/nixos/agares/ntp.nix
new file mode 100644
index 0000000..c3ec49b
--- /dev/null
+++ b/nixos/agares/ntp.nix
@@ -0,0 +1,12 @@
+{ ... }:
+{
+ services.chrony = {
+ enable = true;
+ extraConfig = ''
+ allow 192.168.1
+ allow 192.168.100
+ allow 192.168.101
+ allow 192.168.102
+ '';
+ };
+}
diff --git a/nixos/agares/ppp.nix b/nixos/agares/ppp.nix
new file mode 100644
index 0000000..dc26e46
--- /dev/null
+++ b/nixos/agares/ppp.nix
@@ -0,0 +1,63 @@
+{ pkgs, lib, config, ... }:
+let
+ secretsPath = config.dadada.secrets.path;
+in
+{
+ # PPPoE
+ services.pppd = {
+ enable = true;
+ peers = {
+ telekom = {
+ enable = true;
+ autostart = true;
+ config = ''
+ debug
+
+ plugin pppoe.so enp2s0
+
+ noauth
+ hide-password
+ call telekom-secret
+
+ linkname ppp0
+
+ persist
+ maxfail 0
+ holdoff 5
+
+ noipdefault
+ defaultroute
+
+ lcp-echo-interval 15
+ lcp-echo-failure 3
+ '';
+ };
+ };
+ };
+
+ age.secrets."etc-ppp-telekom-secret" = {
+ file = "${secretsPath}/etc-ppp-telekom-secret.age";
+ owner = "root";
+ mode = "700";
+ path = "/etc/ppp/peers/telekom-secret";
+ };
+
+ age.secrets."etc-ppp-pap-secrets" = {
+ # format: client server passphrase
+ file = "${secretsPath}/etc-ppp-chap-secrets.age";
+ owner = "root";
+ mode = "700";
+ path = "/etc/ppp/pap-secrets";
+ };
+
+ # Hook for QoS via Intermediate Functional Block
+ environment.etc."ppp/ip-up" = {
+ mode = "755";
+ text = with lib; ''
+ #!/usr/bin/env sh
+ ${getBin pkgs.iproute2}/bin/tc qdisc del dev $1 ingress
+ ${getBin pkgs.iproute2}/bin/tc qdisc add dev $1 handle ffff: ingress
+ ${getBin pkgs.iproute2}/bin/tc filter add dev $1 parent ffff: matchall action mirred egress redirect dev ifb4ppp0
+ '';
+ };
+}
diff --git a/nixos/agares/rules.nft b/nixos/agares/rules.nft
new file mode 100644
index 0000000..733ef57
--- /dev/null
+++ b/nixos/agares/rules.nft
@@ -0,0 +1,140 @@
+flush ruleset
+
+define IF_MGMT = "enp1s0"
+define IF_FF = "ff.11"
+define IF_LAN = "lan.10"
+define IF_WAN = "ppp0"
+define IF_SRV = "srv.13"
+
+# Modem uses this for internet uplink via our WAN
+define IF_MODEM = "enp2s0"
+
+define IF_ROADW = "roadwarrior"
+
+table inet filter {
+ # Will give "no such file or directory if hardware does not support flow offloading"
+ # flowtable f {
+ # hook ingress priority 0; devices = { enp1s0, enp2s0 }; flags offload;
+ # }
+
+ chain input_local {
+ ip6 saddr != ::1/128 log prefix "Dropped IPv6 nonlocalhost packet on loopback:" drop
+ accept comment "Accept traffic to loopback interface"
+ }
+
+ chain input_icmp_untrusted {
+ # Allow ICMP echo
+ ip protocol icmp icmp type { echo-request } limit rate 1000/second burst 5 packets accept comment "Accept echo request"
+
+ # Allow some ICMPv6
+ icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, parameter-problem, mld-listener-query, mld-listener-report, mld-listener-done, mld-listener-reduction, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, mld2-listener-report } limit rate 1000/second burst 5 packets accept comment "Allow some ICMPv6"
+ }
+
+ chain input_modem {
+ jump input_icmp_untrusted
+ }
+
+ chain input_wan {
+ # DHCPv6 client
+ meta nfproto ipv6 udp sport 547 accept comment "Allow DHCPv6 client"
+
+ jump input_icmp_untrusted
+
+ udp dport 51234 accept comment "Wireguard roadwarriors"
+ }
+
+ chain input_lan {
+ counter accept comment "Accept all traffic from LAN"
+ }
+
+ chain input_mgmt {
+ counter accept comment "Accept all traffic from MGMT"
+ }
+
+ chain input_srv {
+ counter accept comment "Accept all traffic from services"
+ }
+
+ chain input_roadw {
+ counter accept comment "Accept all traffic from roadwarriors"
+ }
+
+ chain input_ff {
+ jump input_icmp_untrusted
+
+ # DHCP
+ meta nfproto ipv6 udp dport 547 accept comment "Allow DHCPv6 client"
+
+ # Allow DNS and DHCP from Freifunk
+ udp dport { 53, 67 } accept comment "Allow DNS and DHCP from Freifunk"
+ }
+
+ chain input {
+ type filter hook input priority filter; policy drop;
+
+ ct state {established, related} counter accept comment "Accept packets from established and related connections"
+ ct state invalid counter drop comment "Early drop of invalid packets"
+
+ iifname vmap { lo : accept, $IF_WAN : jump input_wan, $IF_LAN : jump input_lan, $IF_FF : jump input_ff, $IF_ROADW : jump input_roadw, $IF_MODEM : jump input_modem, $IF_MGMT : jump input_mgmt }
+ }
+
+# Only works if hardware flow offloading is available
+# chain offload {
+# type filter hook forward priority -100; policy accept;
+# ip protocol tcp flow add @f
+# counter packets 0 bytes 0
+# }
+
+ chain forward {
+ type filter hook forward priority filter; policy drop;
+
+ # Accept connections tracked by destination NAT
+ ct status dnat counter accept comment "Accept connections tracked by DNAT"
+
+ # TCP options
+ tcp flags syn tcp option maxseg size set rt mtu comment "Remove TCP maximum segment size and set a size based on route information"
+
+ # ICMPv6
+ icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, echo-reply, parameter-problem } limit rate 5/second counter accept comment "Forward up to five ICMP messages of allowed types per second"
+ meta l4proto ipv6-icmp accept comment "Forward ICMP in IPv6"
+
+ # mgmt <-> *
+ iifname { $IF_LAN, $IF_ROADW } oifname $IF_MGMT counter reject comment "Reject traffic from LAN and roadwarrior to MGMT"
+ iifname $IF_MGMT oifname { $IF_LAN, $IF_ROADW } counter reject comment "Reject traffic from MGMT to LAN and roadwarrior"
+ # drop (instead of reject) everything else to MGMT
+
+ # LAN, ROADW -> * (except mgmt)
+ iifname { $IF_LAN, $IF_ROADW } counter accept comment "Allow all traffic forwarding from LAN and roadwarrior to all interfaces, except to mgmt"
+
+ # FF -> WAN
+ iifname $IF_FF oifname $IF_WAN counter accept comment "Allow all traffic forwarding from Freifunk to WAN"
+
+ # { WAN, SRV } -> { FF, LAN, RW, SRV }
+ iifname { $IF_WAN, $IF_SRV } oifname { $IF_FF, $IF_LAN, $IF_ROADW, $IF_SRV } ct state established,related counter accept comment "Allow established back from WAN and SRV"
+
+ # WAN -> SRV
+ iifname $IF_WAN oifname $IF_SRV tcp dport ssh accept comment "Allow all SSH traffic forwarding from WAN to services"
+ }
+
+ chain output {
+ type filter hook output priority 100; policy accept;
+ }
+}
+
+table ip nat {
+ chain prerouting {
+ type nat hook prerouting priority dstnat; policy accept;
+ }
+
+ chain postrouting {
+ type nat hook postrouting priority srcnat; policy accept;
+ ip saddr { 192.168.96.0/19 } oifname { $IF_WAN } masquerade comment "Masquerade traffic from LANs"
+ }
+}
+
+table arp filter {
+ chain input {
+ type filter hook input priority filter; policy drop;
+ iifname { $IF_MGMT, $IF_LAN, $IF_FF, $IF_MODEM } limit rate 1/second burst 2 packets accept comment "Limit number of ARP messages from LAN, FF, MGMT, modem"
+ }
+}
diff --git a/secrets/etc-ppp-chap-secrets.age b/secrets/etc-ppp-chap-secrets.age
new file mode 100644
index 0000000..8e50189
--- /dev/null
+++ b/secrets/etc-ppp-chap-secrets.age
@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 L7f05w xkw7tPnkvX1TGG2/Urocw8mQe6r2/Fpxkvs1Nr3cVXs
+eJyvIUrFp0mGWXcmHjP1+5YW9cgs9m8bqUnwgm8iMi0
+-> ssh-ed25519 Otklkw 1IfE9jxV6gz7yfPmSmXsTWsB36RFHmdpjw5eUlElTCo
+GyTNhYhDbD2olE6DiKkr47Mu9NMBMHsO5/pTkcx8WXk
+-> ~6#g&f-grease
+lIbAZllBnOK9YRMIQfPX/veMc111/u5w83pQGuMMWUSyaHT0xwxp8IYn+R9m9iV0
+haQXgTSuQxPhGUJg+1wwncJwnYgzDcCPruprrFTmf0s5HZDr
+--- n9uSP8ZmTTZ89mlRiNKtRfAEz7NV7Yn0ZQhzP4uh4fo
+�#����K���~l�Y�_!�1!fz��@
+O�FИ(��Z�!�Ȣʟ8aB�^��!C FP��[h$�Oaf����e�(l:X��*p����
\ No newline at end of file
diff --git a/secrets/etc-ppp-telekom-secret.age b/secrets/etc-ppp-telekom-secret.age
new file mode 100644
index 0000000..613016e
--- /dev/null
+++ b/secrets/etc-ppp-telekom-secret.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 L7f05w HrgIGi6lUHRxv9JkCfrZaEHYlB0uBOhwVrE7FA7fWR0
+YJEklSLR9XWt9Z3Vwjgc9hR7JgcYr7l1lxCCU4TJeOw
+-> ssh-ed25519 Otklkw ght72AYlMNBSIdVFjgEmmtNvn0fAfmJSJv6ipacc8XQ
+M8qx5eXPdKQo+S1iBGuH3UtOCZxKNpgkMVd5hYaC4/k
+-> W)K(iXJ-grease B=`{E
+52GLQ+oAwz2AphOjy9U5s9m4rn+YLqauNMvZHQy0l4aEijJr/xdkrgizKs7QpA
+--- WG1fXgkKmTl1uge3LGCQFa40X1noXQcMDr21hlhfAu8
+OmU���
��sG m
;<>jI�� p�㘦x[�n�ݕ�л!�n�
W�n��=�0Z��Ɯ���I��w-��
%�46
\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 3cdc77b..0328299 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -23,7 +23,10 @@ in
"paperless.age".publicKeys = [ systems.gorgon dadada ];
"surgat-ssh_host_ed25519_key.age".publicKeys = [ systems.surgat dadada ];
"ninurta-initrd-ssh-key.age".publicKeys = [ systems.ninurta dadada ];
- "ddns-credentials.age".publicKeys = [ systems.ninurta dadada ];
+ "ddns-credentials.age".publicKeys = [ systems.agares systems.ninurta dadada ];
+ "etc-ppp-chap-secrets.age".publicKeys = [ systems.agares dadada ];
+ "etc-ppp-telekom-secret.age".publicKeys = [ systems.agares dadada ];
+ "wg-privkey-vpn-dadada-li.age".publicKeys = [ systems.agares dadada ];
} //
backupSecrets "ninurta" //
backupSecrets "gorgon" //
diff --git a/secrets/wg-privkey-vpn-dadada-li.age b/secrets/wg-privkey-vpn-dadada-li.age
new file mode 100644
index 0000000..43f6549
--- /dev/null
+++ b/secrets/wg-privkey-vpn-dadada-li.age
@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 L7f05w 626jkdszE7nFjXsB8InmF9c7z0g6Lx45rXviJJVipgk
+HOo5D8bIXEUWN+OQOrAtsheqEFpoTEljiQN9iLsGYFw
+-> ssh-ed25519 Otklkw MoBeg8zEAs7S8yRN4kMWFmh1wpFG9a3sIl7B3933U0I
+KHbNqlQgIfC4oOaXnCHuiXxlmqjwrnR72IdTd18yCVQ
+-> ~\AYPd-grease +[i?zA&
+k2qPi9GkmpHdaMnPqWsMPWdqa00MdrneQSDEixtbPmedrzPD1w
+--- R5nczLpf0MEbOrJBfTOM2mHkh3zbWxZRAn6Ke4PsHSg
+[V$�����q
+ �@ �<_���T��YfxM� ��|��؝)���U�k��]93�R� �]����� �!rĬ����K
\ No newline at end of file