fi/nix-infra
1
2
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity

Migrate valkyrie to sops-nix

Browse source
This commit is contained in:
Fiona Grzebien 2026-05-24 02:00:19 +02:00
commit d845904ecd
Signed by: fi
SSH key fingerprint: SHA256:HQgl5VGC4+Yw3ds/0I/DqTge63SPBXvXwhNG/gRW26U
4 changed files with 75 additions and 59 deletions
Download patch file Download diff file Expand all files Collapse all files

49
config/hosts/valkyrie/configuration.nix
View file

@ -23,26 +23,26 @@
{
name = "site1-grzb";
publicKey = "SJ8xCRb4hWm5EnXoV4FnwgbiaxmY2wI+xzfk+3HXERg=";
presharedKeyFile = "/secrets/wireguard-valkyrie-site1-grzb-psk.secret";
presharedKeyFile = "/run/secrets/wireguard-valkyrie-site1-grzb-psk";
endpoint = "site1.grzb.de:51826";
allowedIPs = [ "10.203.10.1/32" "10.201.0.0/16" ];
}
{
name = "site2-grzb";
publicKey = "BbNeBTe6HwQuHPK+ZQXWYRZJJMPdS0h81n07omYyRl4=";
presharedKeyFile = "/secrets/wireguard-valkyrie-site2-grzb-psk.secret";
presharedKeyFile = "/run/secrets/wireguard-valkyrie-site2-grzb-psk";
endpoint = "site2.grzb.de:51826";
allowedIPs = [ "10.203.10.2/32" "10.202.0.0/16" ];
}
{
name = "site1-jsts";
publicKey = "u9h+D8XZ62ABnetBRKnf6tjs+tJwM8fQ4d6ipOCLFyE=";
presharedKeyFile = "/secrets/wireguard-valkyrie-site1-jsts-psk.secret";
presharedKeyFile = "/run/secrets/wireguard-valkyrie-site1-jsts-psk";
endpoint = "site1.jsts.xyz:51823";
allowedIPs = [ "10.203.10.4/32" ];
}
];
privateKeyFile = "/secrets/wireguard-valkyrie-wg0-privatekey.secret";
privateKeyFile = "/run/secrets/wireguard-valkyrie-wg0-privatekey";
};
# mail-1 VPN
wg1 = {
@ -54,7 +54,7 @@
{
name = "mail-1";
publicKey = "CyKPjkY1ah/lE6V3R0XugNo28doeAtD8wEtAeDB7bHs=";
presharedKeyFile = "/secrets/wireguard-valkyrie-mail-1-valkyrie-psk.secret";
presharedKeyFile = "/run/secrets/wireguard-valkyrie-mail-1-valkyrie-psk";
allowedIPs = [ "172.18.50.2/32" ];
}
];
@ -66,7 +66,7 @@
${pkgs.iptables}/bin/iptables -D FORWARD -i wg1 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 172.18.50.0/24 -o ens3 -j MASQUERADE
'';
privateKeyFile = "/secrets/wireguard-valkyrie-wg1-privatekey.secret";
privateKeyFile = "/run/secrets/wireguard-valkyrie-wg1-privatekey";
};
};
};
@ -96,5 +96,42 @@
services.prometheus.exporters.node.enable = false;
sops.secrets."wireguard-valkyrie-wg0-privatekey" = {
mode = "0440";
owner = "root";
group = "root";
restartUnits = [ "wireguard-wg0.service" ];
};
sops.secrets."wireguard-valkyrie-site1-grzb-psk" = {
mode = "0440";
owner = "root";
group = "root";
restartUnits = [ "wireguard-wg0.service" ];
};
sops.secrets."wireguard-valkyrie-site2-grzb-psk" = {
mode = "0440";
owner = "root";
group = "root";
restartUnits = [ "wireguard-wg0.service" ];
};
sops.secrets."wireguard-valkyrie-site1-jsts-psk" = {
mode = "0440";
owner = "root";
group = "root";
restartUnits = [ "wireguard-wg0.service" ];
};
sops.secrets."wireguard-valkyrie-wg1-privatekey" = {
mode = "0440";
owner = "root";
group = "root";
restartUnits = [ "wireguard-wg1.service" ];
};
sops.secrets."wireguard-valkyrie-mail-1-valkyrie-psk" = {
mode = "0440";
owner = "root";
group = "root";
restartUnits = [ "wireguard-wg1.service" ];
};
system.stateVersion = "24.11";
}