2 files changed, 33 insertions, 33 deletions

diff --git a/hosts/surtr/vpn/default.nix b/hosts/surtr/vpn/default.nix
index 636dab1a..3f7483bd 100644
--- a/hosts/surtr/vpn/default.nix
+++ b/hosts/surtr/vpn/default.nix
@@ -15,18 +15,22 @@ in {
     containers."vpn" = {
       autoStart = true;
       ephemeral = true;
+      additionalCapabilities = [
+        "CAP_SYS_TTY_CONFIG" "CAP_NET_ADMIN" "CAP_NET_RAW" "CAP_SYS_ADMIN"
+      ];
       extraFlags = [
+        "--load-credential=surtr.priv:/run/credentials/container@vpn.service/surtr.priv"
         "--network-ipvlan=ens3:upstream"
-        "--load-credential=surtr.priv:${config.sops.secrets.vpn.path}"
       ];
-
       config = {
         boot.kernel.sysctl = {
           "net.core.rmem_max" = 4194304;
           "net.core.wmem_max" = 4194304;
+
           "net.ipv6.conf.all.forwarding" = 1;
-          "net.ipv6.conf.default.forwarding"= 1;
+          "net.ipv6.conf.default.forwarding" = 1;
           "net.ipv4.conf.all.forwarding" = 1;
+          "net.ipv4.conf.default.forwarding" = 1;
         };
 
         environment = {
@@ -81,10 +85,8 @@ in {
                 ListenPort = 51820;
               };
               wireguardPeers = imap1 (i: { name, ip ? i }: {
-                wireguardPeerConfig = {
-                  AllowedIPs = ["${prefix6}:${toString ip}::/96" "${prefix4}.${toString ip}/32"];
-                  PublicKey = trim (readFile (./. + "/${name}.pub"));
-                };
+                AllowedIPs = ["${prefix6}:${toString ip}::/96" "${prefix4}.${toString ip}/32"];
+                PublicKey = trim (readFile (./. + "/${name}.pub"));
               }) [ { name = "geri"; } { name = "sif"; } ];
             };
           };
@@ -104,19 +106,13 @@ in {
                 MulticastDNS = false;
               };
               routes = [
-                { routeConfig = {
-                    Destination = "202.61.240.1";
-                  };
+                { Destination = "202.61.240.1";
                 }
-                { routeConfig = {
-                    Destination = "0.0.0.0/0";
-                    Gateway = "202.61.240.1";
-                  };
+                { Destination = "0.0.0.0/0";
+                  Gateway = "202.61.240.1";
                 }
-                { routeConfig = {
-                    Destination = "::/0";
-                    Gateway = "fe80::1";
-                  };
+                { Destination = "::/0";
+                  Gateway = "fe80::1";
                 }
               ];
               extraConfig = ''
@@ -132,13 +128,9 @@ in {
               };
               address = ["${prefix6}::/96" "${prefix4}.0/32"];
               routes = [
-                { routeConfig = {
-                    Destination = "${prefix6}::/80";
-                  };
+                { Destination = "${prefix6}::/80";
                 }
-                { routeConfig = {
-                    Destination = "${prefix4}.0/24";
-                  };
+                { Destination = "${prefix4}.0/24";
                 }
               ];
               linkConfig = {
@@ -154,6 +146,16 @@ in {
       };
     };
 
+    systemd.services = {
+      "container@vpn" = {
+        serviceConfig = {
+          LoadCredential = [
+            "surtr.priv:${config.sops.secrets.vpn.path}"
+          ];
+        };
+      };
+    };
+
     sops.secrets.vpn = {
       format = "binary";
       sopsFile = ./surtr.priv;
diff --git a/hosts/surtr/vpn/sif.priv b/hosts/surtr/vpn/sif.priv
index a3c13416..25afb9fa 100644
--- a/hosts/surtr/vpn/sif.priv
+++ b/hosts/surtr/vpn/sif.priv
@@ -7,19 +7,17 @@
                 "hc_vault": null,
                 "age": [
                         {
-                                "recipient": "age1ure0athvtnaqqw48pe0y3upqdzmkaen9h70yggd9va4hva6avd8qqm6s4d",
-                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjVzdKYllJMkJ5TE1lY25D\nOTh6WGtYcmRhY244MUdyRnFCa3ZTMGx4ZVFjCllRaElWVlZ1b0dKL09qUWNEYkhS\nNnowRFdjSDVnSzNLQVByQm00Q1NHWFEKLS0tIDhiN2pjeU1nL2tWMFFrZUl1TGto\nY04wY0o3ZEhsR3hrQjh1eHREZHgrUXcKhd3BZiC6NfQ1kDvpN+HG4z6xdLJZaR7B\nvyEQ/p0VpNKXW83BhiM+FFzJ0WLP7nS7gQ89RyjAOQ0/oIb+b29xiw==\n-----END AGE ENCRYPTED FILE-----\n"
+                                "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArOEFxOWNVZEVHRUlXTHg0\nTXV1Q2ZuQmtmek5GeHZXbFZwaU5tbDVnY2lrCnBldG9KTXEvM3kyVjFFQmF3OUxW\neE5oODVKSmVaTnZJSnhjVmZlVGpMbzgKLS0tIGptV3VFai90RHlHT2JyN2k4UFBK\nTHVXL3N3MjdOV1lJZ2ZDM3Z4SFlUZnMKGJEoiGIUJYqDKa24LV5Et8g2oTzGZFPW\n7+/sUTwqsbxPNhHscx89G063QoLjoWGCJ5RERUj+6Qcd49ja4jn07Q==\n-----END AGE ENCRYPTED FILE-----\n"
+                        },
+                        {
+                                "recipient": "age1fj65apkhfkrwyv5tx6zcs9nkjg8267fy733qph30sc7zfn7vapjqkd5kne",
+                                "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMdmJKR0REWUVZL3Z4ODlT\nS1J6SUsvaTBpRXlHR1hON1RldUZ3TklMUGlBClZVMG4yQ0ppcWRhcTZTNmsvQnl2\nTGJ2VlhVS3U5NU9tTXZ5ZURqbkxBejgKLS0tIDkxOTF3WDk2Slp3K3pTYkNFOEt5\ndDU0bjl4RDRyM25ZUmNMOWNHYVFya0UKn8ptfrHhagqepWz1wKxmiM7U0pSv41xh\n0RHpQwFXCUjIPuntZD2e4fLxfU11gpPvdVB42uILG/IYhJUX9ejf+w==\n-----END AGE ENCRYPTED FILE-----\n"
                         }
                 ],
                 "lastmodified": "2022-07-29T12:15:02Z",
                 "mac": "ENC[AES256_GCM,data:MQFmmdTgHlwYplUt51VdMUAnezhypB0Yh0PW5LX4L0lsF0/qlHofRXvqHYI6sx21r8UuTjvLIZ+7LSo8px2wELDol77ufh1zxSDBdbGq6J2ITPEMtmqIXwGJQKweEBr4B4H4mxoiIVQUgNj5TxzxhL7KTm+sVi1uCqTcJjnSY5o=,iv:YJ1GuHd3I4QaJxSJitLrUagaBth1jcQNlIAIahiOCgs=,tag:pcFpscLzTe1egToIzcZh8Q==,type:str]",
-                "pgp": [
-                        {
-                                "created_at": "2023-01-30T10:58:41Z",
-                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdA8xX+2sUmk2pxjs8kIEoCSijlD2Fpc+4iDBfFbT5Apxkw\nTQYHXzajO77NqiRFu/6s/pzZRhzqlWb6+SqZ31BCws/IZjChXQjrV3p1biAQh5Y7\n0lwBVMoawwg2glvW1CanysrUTC4T0r70CViYhoM7RuwRp79FA4r7xKWct+Igsk8V\n6wy13zSRhPqK5yC9Xk5GmMlUiSu1f5SDTQ+dD+QNjHp0JninoNmTxfPrBbLfpg==\n=eeWj\n-----END PGP MESSAGE-----\n",
-                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
-                        }
-                ],
+                "pgp": null,
                 "unencrypted_suffix": "_unencrypted",
                 "version": "3.7.3"
         }