8 files changed, 113 insertions, 12 deletions

diff --git a/hosts/surtr/bifrost/default.nix b/hosts/surtr/bifrost/default.nix
new file mode 100644
index 00000000..8f1e602d
--- /dev/null
+++ b/hosts/surtr/bifrost/default.nix
@@ -0,0 +1,66 @@
+{ config, lib, ... }:
+
+with lib;
+
+let
+  trim = str: if hasSuffix "\n" str then trim (removeSuffix "\n" str) else str;
+in {
+  config = {
+    systemd.network = {
+      netdevs = {
+        bifrost = {
+          netdevConfig = {
+            Name = "bifrost";
+            Kind = "wireguard";
+          };
+          wireguardConfig = {
+            PrivateKeyFile = config.sops.secrets.bifrost.path;
+            ListenPort = 51822;
+          };
+          wireguardPeers = [
+            { wireguardPeerConfig = {
+                AllowedIPs = [ "2a03:4000:52:ada:4:1::/96" ];
+                PublicKey = trim (readFile ../../vidhar/network/bifrost/vidhar.pub);
+              };
+            }
+          ];
+        };
+      };
+      networks = {
+        bifrost = {
+          name = "bifrost";
+          matchConfig = {
+            Name = "bifrost";
+          };
+          address = ["2a03:4000:52:ada:4::/96"];
+          routes = [
+            { routeConfig = {
+                Destination = "2a03:4000:52:ada:4::/80";
+              };
+            }
+          ];
+          linkConfig = {
+            RequiredForOnline = false;
+          };
+          networkConfig = {
+            LLMNR = false;
+            MulticastDNS = false;
+          };
+        };
+      };
+    };
+    sops.secrets.bifrost = {
+      format = "binary";
+      sopsFile = ./surtr.priv;
+      mode = "0640";
+      owner = "root";
+      group = "systemd-network";
+    };
+    environment.etc."systemd/networkd.conf" = {
+      text = ''
+        [Network]
+        RouteTable=bifrost:1026
+      '';
+    };
+  };
+}
diff --git a/hosts/surtr/bifrost/surtr.priv b/hosts/surtr/bifrost/surtr.priv
new file mode 100644
index 00000000..e7f2aeb4
--- /dev/null
+++ b/hosts/surtr/bifrost/surtr.priv
@@ -0,0 +1,26 @@
+{
+        "data": "ENC[AES256_GCM,data:Q3KFfWy4UQIbXfoR6jIb02r0735fvMMHqAWtqOE/BZfe/FuJUkb+HSSJbAkt,iv:YsaIx6eYfLOv1H3IammluRd9XDJAr6o4/HaHgtL8ZUc=,tag:uyINYQ0BGhi6TAuQkPCbBA==,type:str]",
+        "sops": {
+                "kms": null,
+                "gcp_kms": null,
+                "azure_kv": null,
+                "hc_vault": null,
+                "age": null,
+                "lastmodified": "2022-02-06T16:09:36Z",
+                "mac": "ENC[AES256_GCM,data:lzg4JDAyy1tL4dcuima26VWqQmCbr25+8AoecVIctX61V2STXiKzd938bEoJ02UVEPYAUzq+NP5fX6IrggYx2A0tII7oyo92EGBYJsvuCBpZWhZKpniXDsRcQo09PH3QJlJ9liSM8bCf6u//ubGU06xvLldt+g4xvvNOVfqMPSo=,iv:Ya2o/hhg18zp7PqLNSHJAAkyz/Lzibysylqsh0CvMzs=,tag:zeZZ0ilsCa/As7VOSCRgSQ==,type:str]",
+                "pgp": [
+                        {
+                                "created_at": "2022-02-06T16:09:36Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DyFKFNkTVG5oSAQdAx1FJFTdMFdAzIAwO1rZ9ikD/cP1nTzfI1wLZf5ufB3Uw\nY8JVtL/aSLaO3tli5eZNuz6tEhTFA0GU8l3c/Ws6ocjC+l3IR5bS2CGZbMHjyIyT\n0l4BgxRFBMFJdpbgpIEPsthgZwJRGNQofSJ7A6/550ekM5b/n77CBZQOHwocuJ4q\n7LCSH6kFUH8GgkSC26OLC8f/QpWr9zTneZP0mBd2CiADDCg6oPI3rGwq6+jQKNny\n=wDDa\n-----END PGP MESSAGE-----\n",
+                                "fp": "7ED22F4AA7BB55728B643DC5471B7D88E4EF66F8"
+                        },
+                        {
+                                "created_at": "2022-02-06T16:09:36Z",
+                                "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdActA18sJwR4mjwyilHzHHBBuReg88U8QVMLphsqFvHFIw\nV5OTgNNvwiCPHSvGiYQ41Fnxa3VVDu0b3HSsq1Xvf5aFf65cRW39t/JHruwkpd1M\n0l4BbBOw5pksAlRcX25PNIIg7WEq4mlJjCi41INKJ1lF5YEu9kVZHT/+ayU6N5Kf\nVH3I6bpZiIKMc4fnF+yiVbCTWNC3EYTeCpe/ZnM8Gd0WLJh0KsLS+QVzMYagMHNm\n=Cc3x\n-----END PGP MESSAGE-----\n",
+                                "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
+                        }
+                ],
+                "unencrypted_suffix": "_unencrypted",
+                "version": "3.7.1"
+        }
+}
\ No newline at end of file
diff --git a/hosts/surtr/bifrost/surtr.pub b/hosts/surtr/bifrost/surtr.pub
new file mode 100644
index 00000000..2f6ec1b6
--- /dev/null
+++ b/hosts/surtr/bifrost/surtr.pub
@@ -0,0 +1 @@
+/s2yJlJKmy/vt+r/A4z2dof8CBs95KW7CeWLtOb0ERc=
diff --git a/hosts/surtr/default.nix b/hosts/surtr/default.nix
index be148b05..cfb218da 100644
--- a/hosts/surtr/default.nix
+++ b/hosts/surtr/default.nix
@@ -2,7 +2,7 @@
 {
   imports = with flake.nixosModules.systemProfiles; [
     qemu-guest openssh rebuild-machines zfs
-    ./zfs.nix ./dns ./tls.nix ./http.nix
+    ./zfs.nix ./dns ./tls.nix ./http.nix ./bifrost
   ];
 
   config = {
diff --git a/hosts/surtr/dns/zones/li.141.soa b/hosts/surtr/dns/zones/li.141.soa
index 260a09b5..6620a0a3 100644
--- a/hosts/surtr/dns/zones/li.141.soa
+++ b/hosts/surtr/dns/zones/li.141.soa
@@ -1,7 +1,7 @@
 $ORIGIN 141.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. (
-  2022020102 ; serial
+  2022020600 ; serial
   10800      ; refresh
   3600       ; retry
   604800     ; expire
@@ -27,7 +27,7 @@ $TTL 3600
 surtr                   IN      A       202.61.241.61
 surtr                   IN      AAAA    2a03:4000:52:ada::
 surtr                   IN      MX      0 ymir.yggdrasil.li
-surtr                   IN      TXT     "v=spf1 redirect=ullr.yggdrasil.li"
+surtr                   IN      TXT     "v=spf1 redirect=yggdrasil.li"
 
 webdav                  IN      CNAME   surtr.yggdrasil.li.
 
diff --git a/hosts/surtr/dns/zones/li.yggdrasil.soa b/hosts/surtr/dns/zones/li.yggdrasil.soa
index ab89351f..a4fad7a7 100644
--- a/hosts/surtr/dns/zones/li.yggdrasil.soa
+++ b/hosts/surtr/dns/zones/li.yggdrasil.soa
@@ -1,7 +1,7 @@
 $ORIGIN yggdrasil.li.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. (
-  2022020101 ; serial
+  2022020600 ; serial
   10800      ; refresh
   3600       ; retry
   604800     ; expire
@@ -35,7 +35,11 @@ ymir                    IN      TXT     "v=spf1 redirect=yggdrasil.li"
 surtr                   IN      A       202.61.241.61
 surtr                   IN      AAAA    2a03:4000:52:ada::
 surtr                   IN      MX      0 ymir.yggdrasil.li
-surtr                   IN      TXT     "v=spf1 redirect=ullr.yggdrasil.li"
+surtr                   IN      TXT     "v=spf1 redirect=yggdrasil.li"
+
+vidhar                  IN      AAAA    2a03:4000:52:ada:4:1::
+vidhar                  IN      MX      0 ymir.yggdrasil.li
+vidhar                  IN      TXT     "v=spf1 redirect=yggdrasil.li"
 
 mailout                 IN      A       188.68.51.254
 mailout                 IN      AAAA    2a03:4000:6:d004::
diff --git a/hosts/surtr/dns/zones/org.praseodym.soa b/hosts/surtr/dns/zones/org.praseodym.soa
index 4bd6263f..f4fd0d8e 100644
--- a/hosts/surtr/dns/zones/org.praseodym.soa
+++ b/hosts/surtr/dns/zones/org.praseodym.soa
@@ -1,7 +1,7 @@
 $ORIGIN praseodym.org.
 $TTL 3600
 @ IN SOA ns.yggdrasil.li. root.yggdrasil.li. (
-  2022020102 ; serial
+  2022020600 ; serial
   10800      ; refresh
   3600       ; retry
   604800     ; expire
@@ -27,7 +27,7 @@ $TTL 3600
 surtr                   IN      A       202.61.241.61
 surtr                   IN      AAAA    2a03:4000:52:ada::
 surtr                   IN      MX      0 ymir.yggdrasil.li
-surtr                   IN      TXT     "v=spf1 redirect=ullr.yggdrasil.li"
+surtr                   IN      TXT     "v=spf1 redirect=yggdrasil.li"
 
 ymir._domainkey         IN      TXT     ( 
   "v=DKIM1;k=rsa;p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq3cCKlk+VPhyAanLZTM0BCzUT/+fmxHioZcFk0uJk1akBYj7BRofR7eVNcLKpm3rwYMQgE+9vJH9p8SV6tws9EcWc8SMCqqGZlREYM7PmLDiTSK/vjCzkygfgFCb0EBNsY2A/fpP4rTeoxrbcBSvMkq97iY5rwyw4wXZVZXLiDaCj23s8POoxTk1ClqUJZJQ5x2"
diff --git a/hosts/surtr/ruleset.nft b/hosts/surtr/ruleset.nft
index 132360b9..9d6fd373 100644
--- a/hosts/surtr/ruleset.nft
+++ b/hosts/surtr/ruleset.nft
@@ -1,4 +1,4 @@
-define icmp_protos = { ipv6-icmp, icmp, igmp }
+define icmp_protos = {ipv6-icmp, icmp, igmp}
 
 table arp filter {
   limit lim_arp {
@@ -44,12 +44,16 @@ table inet filter {
 
     iifname lo counter accept
 
-    meta l4proto $icmp_protos iifname yggdrasil oifname ens3 limit name lim_icmp counter drop
-    meta l4proto $icmp_protos iifname yggdrasil oifname ens3 counter accept
+    meta l4proto $icmp_protos iifname {yggdrasil, bifrost} oifname ens3 limit name lim_icmp counter drop
+    meta l4proto $icmp_protos iifname {yggdrasil, bifrost} oifname ens3 counter accept
     meta l4proto $icmp_protos ct state {established, related} limit name lim_icmp counter drop
     meta l4proto $icmp_protos ct state {established, related} counter accept
 
 
+    oifname bifrost counter accept
+    iifname bifrost oifname ens3 counter accept
+
+
     limit name lim_reject log prefix "drop forward: " counter drop
     log prefix "reject forward: " counter
     meta l4proto tcp ct state new counter reject with tcp reset
@@ -78,13 +82,13 @@ table inet filter {
     udp dport 60001-61000 counter accept
 
     meta protocol ip udp dport 51820 counter accept
-    meta protocol ip6 udp dport 51821 counter accept
+    meta protocol ip6 udp dport {51821, 51822} counter accept
     iifname "yggdrasil-wg-*" meta l4proto gre counter accept
 
     tcp dport 53 counter accept
     udp dport 53 counter accept
 
-    tcp dport { 80, 443 } counter accept
+    tcp dport {80, 443} counter accept
 
     ct state {established, related} counter accept