From 121e2f5004e109c5fc9530d136aae497061b8ef7 Mon Sep 17 00:00:00 2001
From: Grigory Shipunov
Date: Sat, 18 Jun 2022 11:49:27 +0200
Subject: oxalab: init

---
 hosts/cirrus/configuration.nix    |  7 +------
 hosts/cirrus/default.nix          |  8 ++++++++
 hosts/cirrus/wireguard-server.nix | 43 +++++++++++++++++++++++++++++++++++++++
 hosts/dishwasher/default.nix      |  8 ++++++++
 hosts/dishwasher/oxalab.nix       | 32 +++++++++++++++++++++++++++++
 hosts/dishwasher/secrets.nix      |  9 ++++++++
 hosts/microwave/secrets.nix       |  3 ++-
 7 files changed, 103 insertions(+), 7 deletions(-)
 create mode 100644 hosts/cirrus/default.nix
 create mode 100644 hosts/cirrus/wireguard-server.nix
 create mode 100644 hosts/dishwasher/default.nix
 create mode 100644 hosts/dishwasher/oxalab.nix
 create mode 100644 hosts/dishwasher/secrets.nix

(limited to 'hosts')

diff --git a/hosts/cirrus/configuration.nix b/hosts/cirrus/configuration.nix
index 0054a64..d26af82 100644
--- a/hosts/cirrus/configuration.nix
+++ b/hosts/cirrus/configuration.nix
@@ -5,11 +5,6 @@
 { config, pkgs, ... }:
 
 {
-  imports =
-    [ # Include the results of the hardware scan.
-      ./hardware-configuration.nix
-    ];
-
   # Use the GRUB 2 boot loader.
   boot.loader.grub.enable = true;
   boot.loader.grub.version = 2;
@@ -27,7 +22,7 @@
     networks."uplink" = {
       matchConfig = { Name = "enp1s0"; };
       networkConfig = {
-        DHCP="yes";
+        DHCP="yes"; # hetzner suggests this as default
       };
     };
   };
diff --git a/hosts/cirrus/default.nix b/hosts/cirrus/default.nix
new file mode 100644
index 0000000..7864357
--- /dev/null
+++ b/hosts/cirrus/default.nix
@@ -0,0 +1,8 @@
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./configuration.nix
+    ./secrets.nix
+    ./wireguard-server.nix
+  ];
+}
diff --git a/hosts/cirrus/wireguard-server.nix b/hosts/cirrus/wireguard-server.nix
new file mode 100644
index 0000000..742912e
--- /dev/null
+++ b/hosts/cirrus/wireguard-server.nix
@@ -0,0 +1,43 @@
+{ config, ... }:
+{
+  systemd.network = {
+    netdevs."oxalab" = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "oxalab";
+        Description = "oxa's enterprise network";
+      };
+      wireguardConfig = {
+        PrivateKeyFile = config.sops.secrets."wg/oxalab-seckey".path;
+        ListenPort = 51820;
+        # own pubkey: 5nCVC21BL+1r70OGwA4Q6Z/gcPLC3+ZF8sTurdn7N0E=
+      };
+      wireguardPeers = [
+        {
+          # microwave
+          wireguardPeerConfig = {
+          # nextcloud down, have to keep things in here: https://www.youtube.com/watch?v=1c6v7j1TUBI
+          PublicKey = "0zpfcNrmbsNwwbnDDX4SMl4BVTB0zuhGKixT9TJQoHc=";
+          AllowedIPs = [ "10.66.66.10/32" ];
+          PersistentKeepalive = 25;
+        };
+        }
+        {
+          # Dishwasher
+          wireguardPeerConfig = {
+          # nextcloud down, have to keep things in here: https://www.youtube.com/watch?v=1c6v7j1TUBI
+          PublicKey = "xrremJFIcxwR6snoTUK+mytjez60I91XE120OQGQ7gc=";
+          AllowedIPs = [ "10.66.66.100/32" ];
+          PersistentKeepalive = 25;
+        };
+        }
+      ];
+    };
+    networks."oxalab" = {
+      matchConfig.Name = "oxalab";
+      networkConfig = {
+        Address = "10.13.37.1";
+      };
+    };
+  };
+}
diff --git a/hosts/dishwasher/default.nix b/hosts/dishwasher/default.nix
new file mode 100644
index 0000000..c50e6cf
--- /dev/null
+++ b/hosts/dishwasher/default.nix
@@ -0,0 +1,8 @@
+{
+  imports = [
+    ./configuration.nix
+    ./hardware-configuration.nix
+    ./secrets.nix
+    ./oxalab.nix
+  ];
+}
diff --git a/hosts/dishwasher/oxalab.nix b/hosts/dishwasher/oxalab.nix
new file mode 100644
index 0000000..b6521cf
--- /dev/null
+++ b/hosts/dishwasher/oxalab.nix
@@ -0,0 +1,32 @@
+{ config, ... }:
+{
+  systemd.network = {
+    netdevs."oxalab" = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "oxalab";
+        Description = "oxa's enterprise network";
+      };
+      wireguardConfig = {
+        PrivateKeyFile = config.sops.secrets."wg/oxalab-seckey".path;
+      };
+      wireguardPeers = [
+        {
+          # cirrus
+          wireguardPeerConfig = {
+          PublicKey = "5nCVC21BL+1r70OGwA4Q6Z/gcPLC3+ZF8sTurdn7N0E=";
+          AllowedIPs = [ "10.66.66.0/24" ];
+          Endpoint = [ "95.216.166.21:51820" ];
+          PersistentKeepalive = 25;
+        };
+        }
+      ];
+    };
+    networks."oxalab" = {
+      matchConfig.Name = "oxalab";
+      networkConfig = {
+        Address = "10.13.37.100";
+      };
+    };
+  };
+}
diff --git a/hosts/dishwasher/secrets.nix b/hosts/dishwasher/secrets.nix
new file mode 100644
index 0000000..679c511
--- /dev/null
+++ b/hosts/dishwasher/secrets.nix
@@ -0,0 +1,9 @@
+{ config, ... }:
+{
+  sops.defaultSopsFile = ../../secrets/dishwasher/secrets.yaml;
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets = {
+    "wg/oxalab-seckey" = { };
+  };
+}
diff --git a/hosts/microwave/secrets.nix b/hosts/microwave/secrets.nix
index b343ec8..d7f439c 100644
--- a/hosts/microwave/secrets.nix
+++ b/hosts/microwave/secrets.nix
@@ -1,11 +1,12 @@
 { config, ... }:
 {
-  sops.defaultSopsFile = ../../secrets/secrets.yaml;
+  sops.defaultSopsFile = ../../secrets/microwave/secrets.yaml;
   sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
   sops.secrets = {
     "wg/wg-zw-seckey" = { };
     "wg/wg-dvb-seckey" = { };
     "wg/mlwd-nl-seckey" = { };
+    "wg/oxalab-seckey" = { };
   };
 }
-- 
cgit v1.3.1