aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--machines/nixos/x86_64-linux/argonath.nix41
-rw-r--r--machines/nixos/x86_64-linux/bree.nix33
-rw-r--r--machines/nixos/x86_64-linux/rivendell.nix39
-rw-r--r--profiles/hardware/do-droplet.nix5
-rw-r--r--profiles/hardware/framework-desktop.nix4
-rw-r--r--profiles/hardware/synology-vm.nix3
-rw-r--r--profiles/wireguard.nix58
7 files changed, 73 insertions, 110 deletions
diff --git a/machines/nixos/x86_64-linux/argonath.nix b/machines/nixos/x86_64-linux/argonath.nix
index 218df5a..4b72ca9 100644
--- a/machines/nixos/x86_64-linux/argonath.nix
+++ b/machines/nixos/x86_64-linux/argonath.nix
@@ -1,9 +1,4 @@
-{
- config,
- lib,
- adminUser,
- ...
-}:
+{ adminUser, ... }:
{
imports = [
../../../profiles/acme.nix
@@ -14,40 +9,10 @@
../../../profiles/home-manager.nix
../../../profiles/reverse-proxy.nix
../../../profiles/server.nix
+ ../../../profiles/wireguard.nix
];
- age.secrets.wireguard.file = ../../../secrets/argonath/wireguard.age;
-
- # fixes duplicated devices in mirroredBoots
- boot.loader.grub.devices = lib.mkForce [ "/dev/vda" ];
-
- disko.devices.disk.disk1.device = "/dev/vda";
-
- networking.wireguard = {
- enable = true;
- interfaces.wg0 = {
- ips = [ "10.100.0.51/32" ];
- listenPort = 51871;
- privateKeyFile = config.age.secrets.wireguard.path;
- peers = [
- {
- # bree
- publicKey = "bJZyQoemudGJQox8Iegebm23c4BNVIxRPy1kmI2l904=";
- allowedIPs = [ "10.100.0.40/32" ];
- persistentKeepalive = 25;
- }
- {
- # rivendell
- publicKey = "jf7T7TMKQWSgSXhUplldZDV9G2y2BjMmHIAhg5d26ng=";
- allowedIPs = [ "10.100.0.60/32" ];
- persistentKeepalive = 25;
- }
- ];
- };
- };
-
- networking.firewall.trustedInterfaces = [ "wg0" ];
- networking.firewall.allowedUDPPorts = [ 51871 ];
+ networking.hostName = "argonath";
system.stateVersion = "25.05"; # Did you read the comment?
diff --git a/machines/nixos/x86_64-linux/bree.nix b/machines/nixos/x86_64-linux/bree.nix
index 7296077..2f564b5 100644
--- a/machines/nixos/x86_64-linux/bree.nix
+++ b/machines/nixos/x86_64-linux/bree.nix
@@ -12,44 +12,13 @@
../../../profiles/hardware/synology-vm.nix
../../../profiles/home-manager.nix
../../../profiles/server.nix
+ ../../../profiles/wireguard.nix
];
- age.secrets.wireguard.file = ../../../secrets/bree/wireguard.age;
-
- boot.loader.efi.canTouchEfiVariables = true;
- boot.loader.systemd-boot.enable = true;
-
networking.hostName = "bree";
networking.useDHCP = lib.mkDefault true;
systemd.network.wait-online.anyInterface = lib.mkDefault config.networking.useDHCP;
- networking.wireguard = {
- enable = true;
- interfaces.wg0 = {
- ips = [ "10.100.0.40/32" ];
- listenPort = 51871;
- privateKeyFile = config.age.secrets.wireguard.path;
- peers = [
- {
- # argonath
- publicKey = "vTItDh9YPnA+8hL1kIK+7EHv0ol3qvhfAfz790miw1w=";
- allowedIPs = [ "10.100.0.51/32" ];
- endpoint = "157.230.146.234:51871";
- persistentKeepalive = 25;
- }
- {
- # rivendell
- publicKey = "jf7T7TMKQWSgSXhUplldZDV9G2y2BjMmHIAhg5d26ng=";
- allowedIPs = [ "10.100.0.60/32" ];
- persistentKeepalive = 25;
- }
- ];
- };
- };
-
- networking.firewall.trustedInterfaces = [ "wg0" ];
- networking.firewall.allowedUDPPorts = [ 51871 ];
-
home-manager = {
users.${adminUser.name} = {
imports = [
diff --git a/machines/nixos/x86_64-linux/rivendell.nix b/machines/nixos/x86_64-linux/rivendell.nix
index bd7d01b..3d64722 100644
--- a/machines/nixos/x86_64-linux/rivendell.nix
+++ b/machines/nixos/x86_64-linux/rivendell.nix
@@ -17,18 +17,9 @@
../../../profiles/remote-unlock.nix
../../../profiles/restic-backup.nix
../../../profiles/server.nix
+ ../../../profiles/wireguard.nix
];
- age = {
- secrets = {
- wireguard = {
- file = ../../../secrets/rivendell/wireguard.age;
- };
- };
- };
-
- nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-
networking.hostName = "rivendell";
networking.useDHCP = lib.mkDefault true;
systemd.network.wait-online.anyInterface = lib.mkDefault config.networking.useDHCP;
@@ -46,34 +37,6 @@
nix.settings.trusted-users = [ "builder" ];
- networking.wireguard = {
- enable = true;
- interfaces.wg0 = {
- ips = [ "10.100.0.60/32" ];
- listenPort = 51871;
- privateKeyFile = config.age.secrets.wireguard.path;
- peers = [
- {
- # bree
- publicKey = "bJZyQoemudGJQox8Iegebm23c4BNVIxRPy1kmI2l904=";
- allowedIPs = [ "10.100.0.40/32" ];
- persistentKeepalive = 25;
- endpoint = "192.168.1.50:51871";
- }
- {
- # argonath
- publicKey = "vTItDh9YPnA+8hL1kIK+7EHv0ol3qvhfAfz790miw1w=";
- allowedIPs = [ "10.100.0.51/32" ];
- endpoint = "157.230.146.234:51871";
- persistentKeepalive = 25;
- }
- ];
- };
- };
-
- networking.firewall.trustedInterfaces = [ "wg0" ];
- networking.firewall.allowedUDPPorts = [ 51871 ];
-
services.website = {
enable = true;
openFirewall = true;
diff --git a/profiles/hardware/do-droplet.nix b/profiles/hardware/do-droplet.nix
index aef5805..28d025a 100644
--- a/profiles/hardware/do-droplet.nix
+++ b/profiles/hardware/do-droplet.nix
@@ -1,10 +1,13 @@
{ modulesPath, lib, ... }:
{
-
imports = [
(modulesPath + "/virtualisation/digital-ocean-config.nix")
];
+ # fixes duplicated devices in mirroredBoots
+ boot.loader.grub.devices = lib.mkForce [ "/dev/vda" ];
+ disko.devices.disk.disk1.device = "/dev/vda";
+
# do not use DHCP, as DigitalOcean provisions IPs using cloud-init
networking.useDHCP = lib.mkForce false;
diff --git a/profiles/hardware/framework-desktop.nix b/profiles/hardware/framework-desktop.nix
index 85580d1..b1019b8 100644
--- a/profiles/hardware/framework-desktop.nix
+++ b/profiles/hardware/framework-desktop.nix
@@ -1,4 +1,4 @@
-{ inputs, ... }:
+{ lib, inputs, ... }:
{
imports = [
inputs.nixos-hardware.nixosModules.framework-desktop-amd-ai-max-300-series
@@ -27,4 +27,6 @@
hardware.enableRedistributableFirmware = true;
hardware.cpu.amd.updateMicrocode = true;
+
+ nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
}
diff --git a/profiles/hardware/synology-vm.nix b/profiles/hardware/synology-vm.nix
index 7d784eb..053cf41 100644
--- a/profiles/hardware/synology-vm.nix
+++ b/profiles/hardware/synology-vm.nix
@@ -4,6 +4,9 @@
(modulesPath + "/profiles/qemu-guest.nix")
];
+ boot.loader.efi.canTouchEfiVariables = true;
+ boot.loader.systemd-boot.enable = true;
+
boot.initrd.availableKernelModules = [
"ata_piix"
"uhci_hcd"
diff --git a/profiles/wireguard.nix b/profiles/wireguard.nix
new file mode 100644
index 0000000..a080693
--- /dev/null
+++ b/profiles/wireguard.nix
@@ -0,0 +1,58 @@
+{ config, lib, ... }:
+
+let
+ wgHosts = {
+ bree = {
+ ip = 40;
+ publicKey = "bJZyQoemudGJQox8Iegebm23c4BNVIxRPy1kmI2l904=";
+ endpoint = "192.168.1.50";
+ };
+ argonath = {
+ ip = 51;
+ publicKey = "vTItDh9YPnA+8hL1kIK+7EHv0ol3qvhfAfz790miw1w=";
+ endpoint = "157.230.146.234";
+ };
+ rivendell = {
+ ip = 60;
+ publicKey = "jf7T7TMKQWSgSXhUplldZDV9G2y2BjMmHIAhg5d26ng=";
+ endpoint = "192.168.1.114";
+ };
+ };
+
+ wgPort = 51820;
+ wgSubnet = "10.100.0";
+
+ currentHostname = config.networking.hostName;
+ currentHost =
+ wgHosts.${currentHostname}
+ or (throw "Host ${currentHostname} not found in wireguard configuration");
+
+ peers = lib.mapAttrsToList (
+ _hostname: hostCfg:
+ {
+ publicKey = hostCfg.publicKey;
+ allowedIPs = [ "${wgSubnet}.${toString hostCfg.ip}/32" ];
+ persistentKeepalive = 25;
+ }
+ // lib.optionalAttrs (hostCfg.endpoint != null) {
+ endpoint = "${hostCfg.endpoint}:${toString wgPort}";
+ }
+ ) (lib.filterAttrs (n: _v: n != currentHostname) wgHosts);
+
+in
+{
+ age.secrets.wireguard.file = ../secrets/${currentHostname}/wireguard.age;
+
+ networking.wireguard = {
+ enable = true;
+ interfaces.wg0 = {
+ ips = [ "${wgSubnet}.${toString currentHost.ip}/32" ];
+ listenPort = wgPort;
+ privateKeyFile = config.age.secrets.wireguard.path;
+ inherit peers;
+ };
+ };
+
+ networking.firewall.trustedInterfaces = [ "wg0" ];
+ networking.firewall.allowedUDPPorts = [ wgPort ];
+}
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-06 04:04:52 +0000