From badf7aba844967c5d13e01079c12df758715167a Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Sun, 27 Sep 2026 12:37:52 +0200 Subject: ... --- accounts/gkleen@skadhi/rzm/default.nix | 161 +++++++++++++++++++++++++++++++++ accounts/gkleen@skadhi/rzm/wgrz.priv | 18 ++++ 2 files changed, 179 insertions(+) create mode 100644 accounts/gkleen@skadhi/rzm/default.nix create mode 100644 accounts/gkleen@skadhi/rzm/wgrz.priv (limited to 'accounts/gkleen@skadhi/rzm') diff --git a/accounts/gkleen@skadhi/rzm/default.nix b/accounts/gkleen@skadhi/rzm/default.nix new file mode 100644 index 00000000..efe5468e --- /dev/null +++ b/accounts/gkleen@skadhi/rzm/default.nix @@ -0,0 +1,161 @@ +{ config, pkgs, ... }: +let + mwnSubnetsPublic = + [ "129.187.0.0/16" "141.40.0.0/16" "141.84.0.0/16" + "192.68.211.0/24" "192.68.212.0/24" "192.68.213.0/24" "192.68.214.0/24" "192.68.215.0/24" + "193.174.96.0/22" + "194.95.59.0/24" + ]; + mwnSubnetsPrivate = + [ "10.153.0.0/16" "10.162.0.0/16" "10.156.0.0/16" + ]; +in { + config = { + systemd.network = { + config.routeTables.wgrz = 1025; + netdevs = { + wgrz = { + netdevConfig = { + Name = "wgrz"; + Kind = "wireguard"; + MTUBytes = "1558"; + }; + wireguardConfig = { + PrivateKeyFile = "/run/credentials/systemd-networkd.service/wgrz.priv"; + ListenPort = 51822; + # FirewallMark = 1; + }; + wireguardPeers = [ + { AllowedIPs = [ "10.200.116.1/32" "10.163.88.40/32" ] ++ mwnSubnetsPrivate ++ mwnSubnetsPublic; + PublicKey = "YlRFLc+rD2k2KXl7pIJbOKbcPgdJCl8ZTsv0xlK4VEI="; + PersistentKeepalive = 25; + Endpoint = "wg.math.lmu.de:51820"; + } + ]; + }; + }; + networks = { + wgrz = { + name = "wgrz"; + matchConfig = { + Name = "wgrz"; + }; + address = ["10.200.116.131/24"]; + routes = map (Destination: { + inherit Destination; + Gateway = "10.200.116.1"; + GatewayOnLink = true; + Table = "wgrz"; + }) (mwnSubnetsPrivate ++ mwnSubnetsPublic ++ ["10.163.88.40/32"]); + routingPolicyRules = [ + { Table = "main"; + # FirewallMark = 1; + To = "129.187.111.225"; + Priority = 100; + } + { Table = "main"; + To = "10.153.91.204"; + Priority = 100; + } + { Table = "wgrz"; + From = "10.200.116.131"; + Priority = 200; + } + { Table = "wgrz"; + To = "10.163.88.40"; + Priority = 200; + } + ] ++ map (To: { Table = "wgrz"; + inherit To; + Priority = 200; + }) (mwnSubnetsPrivate ++ mwnSubnetsPublic); + linkConfig = { + RequiredForOnline = false; + }; + networkConfig = { + LLMNR = false; + MulticastDNS = false; + DNS = ["10.153.88.9" "129.187.111.202" "10.156.33.53"]; + # Tunnel = "rz-gre-1"; + }; + }; + }; + }; + networking.networkmanager.unmanaged = ["wgrz"]; + sops.secrets.wgrz = { + format = "binary"; + sopsFile = ./wgrz.priv; + }; + systemd.services."systemd-networkd".serviceConfig.LoadCredential = [ + "wgrz.priv:${config.sops.secrets.wgrz.path}" + ]; + + environment.etc."NetworkManager/dnsmasq.d/wgrz.conf" = { + text = '' + server=/mathinst.loc/10.153.88.9@wgrz + server=/cipmath.loc/10.153.88.9@wgrz + ''; + }; + + home-manager.users.gkleen = { sysConfig, config, ... }: { + home.persistence."/persistent".files = [ + "rz.kdbx" ".config/Element-lmu" + ]; + + xdg.desktopEntries = { + element-lmu = { + name = "Element (LMU)"; + exec = "element-desktop --profile=lmu %u"; + icon = "element"; + genericName = "Matrix Client"; + categories = [ "Network" "InstantMessaging" "Chat" ]; + settings = { + StartupWMClass = "Element"; + }; + }; + thunderbird-lmu = { + name = "Thunderbird (LMU)"; + exec = "thunderbird --name thunderbird -P lmu %U"; + icon = "thunderbird"; + genericName = "Email Client"; + categories = [ "Network" "Chat" "Email" "Feed" "GTK" "News" ]; + settings = { + StartupWMClass = "thunderbird"; + StartupNotify = "true"; + }; + }; + }; + + programs.zsh.dirHashes = { + u2w = "$HOME/projects/uni2work"; + rz = "$HOME/projects/rz"; + pro = "$HOME/projects/pro"; + }; + + programs.ssh.matchBlocks = { + "*.mathinst.loc" = { + match = "host *.mathinst.loc,*.cipmath.loc,*.math.lmu.de"; + identityFile = "~/.ssh/gkleen@mathinst.loc"; + extraOptions = { + HostKeyAlgorithms = "+ssh-rsa"; + PubkeyAcceptedAlgorithms = "+ssh-rsa"; + PasswordAuthentication = "yes"; + GlobalKnownHostsFile = toString (pkgs.writeText "ssh_known_hosts" '' + @cert-authority *.mathinst.loc,*.math.lmu.de,*.cipmath.loc ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBUTFpVCdETCXiDSDl7YGbR1J4BLTsoBzjDtflHJGO/z ssh-pki@mgmt01 + ''); + }; + }; + }; + + home.file = { + ".cups/client.conf".text = '' + ServerName cups.mathinst.loc + ''; + }; + + home.packages = with pkgs; [ + cups + ]; + }; + }; +} diff --git a/accounts/gkleen@skadhi/rzm/wgrz.priv b/accounts/gkleen@skadhi/rzm/wgrz.priv new file mode 100644 index 00000000..d34e96ee --- /dev/null +++ b/accounts/gkleen@skadhi/rzm/wgrz.priv @@ -0,0 +1,18 @@ +{ + "data": "ENC[AES256_GCM,data:HbX+Vd4IpVcWIH/llV3BWnuWwOzNw/bZfjisD38CFNbd/RCPEnuIb2XCNi+4,iv:at3CY0GIDSSQSmiXlnNgLMIGIT5V8CYOCuFyThjMmGE=,tag:ZAttUMhZV56G5A54a8YXbg==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRRU1GNkZtbXgwMjVvVlo2\nMXkvc24rcEgyVEpyMVZwL25QTGYrZzBjT25ZCldraUhhNkFveXhLQ09ibjNUOVJl\nSUkzL0MwbkVQQXgzZkNiQjEwM05BVTAKLS0tIE5rSFRJalJqbERwdzFGeHdrTXFG\nWFdPU21PUEtxbGdibXNVZnYxMUdPaTQKw83yVaRBy4d2YLchQJM5ucZrdTpe0PUZ\nM9SdUP1eGbOIWkeUttG/qsKrLfHT2+GDhydxU6gwKiAfwDr9I3IGCA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBMDVCaTFYZVpmeUg1dWZs\nRHNYM3BSL2liemlaSGRWRTcya3VJUDd2akNNCjQ0N0V1ZTI1ZDhOZTBYMlBWZDdY\nQU1WSVNoMUhrUkgxQVhwL2VNZFVIeTgKLS0tIFhONzNXOXJoUjhOVFYrZWRPeEZJ\ncnpvblRDMDBKbXJjL2JpVUEwZ2NaRTQKNGtFm9ObnEPUHKKsTJaaALHsqFLPr5oO\nlCYIucEMFOYkM7o5wJCtLs5fsigQT6pAkeI3+N/rSz1hhDWuBB+PrQ==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1u6xegt79rarmyz8qy4pl7jh9lh90vx8fg0frmh4u2mzam7zydq4s4agz4e" + } + ], + "lastmodified": "2026-09-27T10:18:59Z", + "mac": "ENC[AES256_GCM,data:BIHCMFB0oMcaByiALqgTaKBd1cNJZlFu3FnB7U0oTtw3Q65mFqrsLsphesuPxZxtD8eAdubT/YIC2rZ5ZCAZz/9eM1nt8tvBkO6ZGXmHeWUGlTpA7K2EAEK4D+8Bo8Xgf8afaTCmbrfKjn64iNQjUrmv8NMoY2Od8sYfIfRdYSs=,iv:d/Jt+ub2VcnJd9n7qwO6/j044D1fNtAmEQtZQrCNeEg=,tag:R7TPkPXyVV5UDsl9x1pboA==,type:str]", + "version": "3.13.3" + } +} -- cgit v1.2.3