summaryrefslogtreecommitdiff
path: root/hosts/vidhar/network/bifrost
diff options
context:
space:
mode:
Diffstat (limited to 'hosts/vidhar/network/bifrost')
-rw-r--r--hosts/vidhar/network/bifrost/default.nix82
-rw-r--r--hosts/vidhar/network/bifrost/vidhar.priv26
-rw-r--r--hosts/vidhar/network/bifrost/vidhar.pub1
3 files changed, 109 insertions, 0 deletions
diff --git a/hosts/vidhar/network/bifrost/default.nix b/hosts/vidhar/network/bifrost/default.nix
new file mode 100644
index 00000000..40666f59
--- /dev/null
+++ b/hosts/vidhar/network/bifrost/default.nix
@@ -0,0 +1,82 @@
1{ config, lib, ... }:
2
3with lib;
4
5let
6 trim = str: if hasSuffix "\n" str then trim (removeSuffix "\n" str) else str;
7in {
8 config = {
9 systemd.network = {
10 netdevs = {
11 bifrost = {
12 netdevConfig = {
13 Name = "bifrost";
14 Kind = "wireguard";
15 };
16 wireguardConfig = {
17 PrivateKeyFile = config.sops.secrets.bifrost.path;
18 ListenPort = 51822;
19 };
20 wireguardPeers = [
21 { wireguardPeerConfig = {
22 AllowedIPs = [ "2a03:4000:52:ada:4::/96" ];
23 PublicKey = trim (readFile ../../../surtr/bifrost/surtr.pub);
24 PersistentKeepalive = 5;
25 Endpoint = "2a03:4000:52:ada:::51822";
26 };
27 }
28 ];
29 };
30 };
31 networks = {
32 bifrost = {
33 name = "bifrost";
34 matchConfig = {
35 Name = "bifrost";
36 };
37 address = ["2a03:4000:52:ada:4:1::/96"];
38 routes = [
39 { routeConfig = {
40 Destination = "2a03:4000:52:ada:4::/80";
41 };
42 }
43 { routeConfig ={
44 Gateway = "2a03:4000:52:ada:4::";
45 GatewayOnLink = true;
46 Table = "bifrost";
47 };
48 }
49 ];
50 routingPolicyRules = [
51 { routingPolicyRuleConfig = {
52 Table = "bifrost";
53 From = "2a03:4000:52:ada:4:1::/96";
54 Priority = 200;
55 };
56 }
57 ];
58 linkConfig = {
59 RequiredForOnline = false;
60 };
61 networkConfig = {
62 LLMNR = false;
63 MulticastDNS = false;
64 };
65 };
66 };
67 };
68 sops.secrets.bifrost = {
69 format = "binary";
70 sopsFile = ./vidhar.priv;
71 mode = "0640";
72 owner = "root";
73 group = "systemd-network";
74 };
75 environment.etc."systemd/networkd.conf" = {
76 text = ''
77 [Network]
78 RouteTable=bifrost:1026
79 '';
80 };
81 };
82}
diff --git a/hosts/vidhar/network/bifrost/vidhar.priv b/hosts/vidhar/network/bifrost/vidhar.priv
new file mode 100644
index 00000000..273e9ba7
--- /dev/null
+++ b/hosts/vidhar/network/bifrost/vidhar.priv
@@ -0,0 +1,26 @@
1{
2 "data": "ENC[AES256_GCM,data:BSnTkjcVap00po3wV+hSXAi3BMDqwlW+PmhHAecVOl7RFxRAdqVLjIctkmDh,iv:CxKBDo81u1RegSq2lKRwRMlyNINyX3DxoFSqT97e5fM=,tag:Akdav4XxLeQnz2xFMjQ3yw==,type:str]",
3 "sops": {
4 "kms": null,
5 "gcp_kms": null,
6 "azure_kv": null,
7 "hc_vault": null,
8 "age": null,
9 "lastmodified": "2022-02-06T16:09:08Z",
10 "mac": "ENC[AES256_GCM,data:SXCQKrqkOoXlm8Mrs7UZ1CGJe/HnHhvNCuGpt8yhsnchWICfGGWEIrh99TrKkia2X1inoElwXQYYPfyKHFshLaoNjH2GduR287OXluxZs+Thnm1Fnq6oZUBO9mDDUlykZAB3Mjm4WmUnirKB87Q6DFtTRZjh26amt3oC6GwnEfE=,iv:NtPsuStBnJuVfnlbxunL9PxbPdlYktJtV+MYSa53Oc8=,tag:HKJayT/YNP8PJ/ZIlKdQSg==,type:str]",
11 "pgp": [
12 {
13 "created_at": "2022-02-06T16:09:08Z",
14 "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DbYDvGI0HDr0SAQdAnjYlc0bHToon5ayDJk+08sRPPEww8MBOprZZswYU1V8w\n5+QzHJXtSbb4lEwKwdwxkkSg1wBiW+kwrV2L2yyYOvoMhWKQsntjQuzaK7I1Kjix\n0l4BOIcMVJEyJk49CEQQyFlqmgJrh9L/dMhl1D7pD842GcpGFxlB7OHRXsLo9axj\nFAuLUc35LyVgnHd2InqDwG0JKiySdI7fN3dXWiD5H3feoCDisBZvaH/5DlufdIl7\n=sLA+\n-----END PGP MESSAGE-----\n",
15 "fp": "A1C7C95E6CAF0A965CB47277BCF50A89C1B1F362"
16 },
17 {
18 "created_at": "2022-02-06T16:09:08Z",
19 "enc": "-----BEGIN PGP MESSAGE-----\n\nhF4DXxoViZlp6dISAQdAeG22AYCyEYq1Fvqj853ZE7oeuOWOrpDOXiAvnSl83EUw\nofhjhoZ9nMyZlsy+nD06hIvaYdcFeAuSV8iHwANAjarmKlnKicT7b7mBCkOjMJDX\n0l4BAox2QUqhcYbGUKT+/Ei7RXYMP8ht1N+iisBVnzN055VrGQhvDadpcpVzQGKH\n8Hbmmdi9O2PQWRYnvRK+0I7GJFiC4Q36Kzf8X9MojMhb/GIwiBKCU0ZK2BLM9FtA\n=WbKA\n-----END PGP MESSAGE-----\n",
20 "fp": "30D3453B8CD02FE2A3E7C78C0FB536FB87AE8F51"
21 }
22 ],
23 "unencrypted_suffix": "_unencrypted",
24 "version": "3.7.1"
25 }
26} \ No newline at end of file
diff --git a/hosts/vidhar/network/bifrost/vidhar.pub b/hosts/vidhar/network/bifrost/vidhar.pub
new file mode 100644
index 00000000..ef05f832
--- /dev/null
+++ b/hosts/vidhar/network/bifrost/vidhar.pub
@@ -0,0 +1 @@
moESFbO3qUTuoOv6lbzSLrNYSjHkM5hyvAs5XZtQzRA=