From 801594dd2168c6d99b34de0bc26ec037aa91ebee Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Thu, 24 Sep 2026 10:56:18 +0200 Subject: ... --- modules/nix-access-tokens/default.nix | 2 +- modules/nix-access-tokens/nix.conf | 20 ++++++++++++-------- modules/yggdrasil-wg/default.nix | 23 +++++++++++++++++++++++ modules/yggdrasil-wg/hosts/4/skadhi.priv | 18 ++++++++++++++++++ modules/yggdrasil-wg/hosts/4/skadhi.pub | 1 + modules/yggdrasil-wg/hosts/6/skadhi.priv | 18 ++++++++++++++++++ modules/yggdrasil-wg/hosts/6/skadhi.pub | 1 + 7 files changed, 74 insertions(+), 9 deletions(-) create mode 100644 modules/yggdrasil-wg/hosts/4/skadhi.priv create mode 100644 modules/yggdrasil-wg/hosts/4/skadhi.pub create mode 100644 modules/yggdrasil-wg/hosts/6/skadhi.priv create mode 100644 modules/yggdrasil-wg/hosts/6/skadhi.pub (limited to 'modules') diff --git a/modules/nix-access-tokens/default.nix b/modules/nix-access-tokens/default.nix index a3b7abfa..fbfb31fc 100644 --- a/modules/nix-access-tokens/default.nix +++ b/modules/nix-access-tokens/default.nix @@ -4,7 +4,7 @@ let cfg = config.nix.includeAccessTokens; in { options = { - nix.includeAccessTokens.enable = lib.mkEnableOption "including access tokens in nix.conf" // { default = lib.elem hostName ["sif" "surtr" "vidhar"]; }; + nix.includeAccessTokens.enable = lib.mkEnableOption "including access tokens in nix.conf" // { default = lib.elem hostName ["sif" "skadhi" "surtr" "vidhar"]; }; }; config = lib.mkIf cfg.enable { diff --git a/modules/nix-access-tokens/nix.conf b/modules/nix-access-tokens/nix.conf index 80d5641c..4d933eaa 100644 --- a/modules/nix-access-tokens/nix.conf +++ b/modules/nix-access-tokens/nix.conf @@ -3,20 +3,24 @@ "sops": { "age": [ { - "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5NkZUUGI3M2pQYWVXeFV6\na2h2czRTeUJFekJCS012YlBkL1FDdTd3ekZ3ClJsTVh0R2JQM0Jua1JjL285RVA1\nRHhlbjlLdmNBUXVLelFGY2NGYWpLejQKLS0tIDBUWUhJNm8zWGoyQ0pBYnV1ZjBh\ndktNRkNPS1lpWXFITC81aEZJbXlONk0Km2c1xVKwSankaVs7O/utGJwRRX395upz\ndPbsOElTnbGmkb0esGtvGSPboTvK+gjn9w/GhaPyTnNDoos7GaIfyg==\n-----END AGE ENCRYPTED FILE-----\n" + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiWDlPazhId0RvZHZKbU9C\nQmR4S293KytMOXI0MmYrc2xxcVBtY0NxL2xjClpJMmdUNE41SVIyeFA3czkwek0r\nckRwVGdWYkJkVWRtRVlxcDFkMmRDSGsKLS0tIGtyOHhMRUR5aVlBQzkrYkh4dVhE\nWHNCUnZCN0NhZ0trQmJaTUJDb3ROMlUKvH5z4Fj1P5zMcwD6UlLT531Ggrd4vEmo\ne2uOmolQ/jcStDd4IMniPEfjqcxfSEtkb7fpB1Rhby0mT6Gx68GtHw==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866" }, { - "recipient": "age1fj65apkhfkrwyv5tx6zcs9nkjg8267fy733qph30sc7zfn7vapjqkd5kne", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bS9iY2lua3U4U3lJa1pK\nSlZNMmFZMEU5M1V2bWRjaXIwajZJVDJPMlM4Cmd3TTNFWjVuSGdtbC9iODltTS91\nOE5XOEVEQkh0SFpVVW5jc3IzbzNpTmMKLS0tIEtrSU54QUVPa2tBZDhLYlRFWitR\nc2x6MFlxL0tobDJTek42dEcyZXpoWDgKXzQfU+o6FkbJBwmm6oaHu4sDPi822uUR\n5VY6gY/h3g2kM4cuS03Q4NJmeRxuh7cx0UqGU3j5Mf8muE1LHpYEPw==\n-----END AGE ENCRYPTED FILE-----\n" + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPNmowYmNTWVNwYk9UNzhI\neXllbWNCWEl4QXk1SUxLcjY5Vm5HdjBCdVRzClh2ZkY0bGUrNE9rUnhNTVdDT2tl\nTjFBYURMdGNWSjZZSDQzVXRBL2xRNXcKLS0tIEk0U05jSWQrUGoraVdxTU5QdEZ6\nQlprZlN5SjRTQzhycERsSVhiZDJmekUKUVzegV7zpd3woOeyDw+Ezpyd3D3xH0SV\nyt/UspleE/+sDRPuJTQKx6wA/k7e+hPJjGdjgMgzGnuCh+dfwNw2lw==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1fj65apkhfkrwyv5tx6zcs9nkjg8267fy733qph30sc7zfn7vapjqkd5kne" }, { - "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaOVpNZ2lVT0VwbHVZNzFl\nenJsMGpnbkRvU0xOSU5obk5yT2p5ZVNzdXhNCnVlQzZtRjZNVmJLSUpKc3UwVXZs\nWi9EZ3kxZkJNeFJDSjl1L1IweTFNMXcKLS0tIDJUOTBwTldCUmlnU0tWVkZkNzJL\nejM4ajJVbVhvSm1YM2Vxa2JldllYN0UKAzxy2wkzRvCSiTy417AulpCu41z668HG\nto92eGF2ZRFfEG5LGlCKWeDcP3gM8QwKiVlm6wndbOkhMMfc4Sp3wA==\n-----END AGE ENCRYPTED FILE-----\n" + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwZW51Q0RWdmtyZmdmNy9H\nMWJGSkxlbXRSc0U1eVhFSm1kZWlhaEl3UUVRCnNWWTVPWGJPaVJET1YrTXFHeGZk\na2ZYVWNQL1FwRStiSlE3ZDJmOVVHcFEKLS0tIEE1WHRsdEJPcWdiQ1lNenN2WDBE\nYW1FR0gyeENHWEpxWFB2a25RZjBOUW8KW2n77OFZXNZLH/HMWhUrwLZM4epFxheZ\nbeOSASmLVkmT4rJOOHoP1g9GxmC8UxSrM1q6uV80n69grExRfgYCig==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1u6xegt79rarmyz8qy4pl7jh9lh90vx8fg0frmh4u2mzam7zydq4s4agz4e" }, { - "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2ejRHcGttNUxYZnFzTU5J\nMTFvY3daQ1VMM2xxYTgvLzZwT1owazVNenhzCktaWFF6K2s5UjI2b20rSHFNSS9E\nMVlJSmZhQm15eUs3U0hGTGpSRndmSDgKLS0tIDVrcjl4eDhwak1pRithbnRWWEZy\nVE9EOEpKdEJoRTFrTXpQVDc1cmsrU1kK/goTdUmpZPeMRbY1QzLXAa6Qpg4YYYYo\n3v3GK1bzdey8szfgIr1dHTtQEzqE2WX1swzZizDXj/RiUWx01Ky3GA==\n-----END AGE ENCRYPTED FILE-----\n" + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBSUFhNWxNd3ZXMlkyU1pC\nUlNsdENaWU9WMGxJbHRqaHM0SEFVdnJ5ZHlrCkF5a0xBWXJpWGxDMEcveVhEVzJh\naFFOVmJtQkh1WlZxcUZVaWxJS1ZBUVEKLS0tIC90bTBUa09yNkhBVDRBa25STzZD\nSnNYa3JqWTBlcjZBMlhIOUdGOFVseEUKZ3El/3f+YWMZBl4Qhhz5qTB/V/zq+e/W\nCPJ7uOJ/2L6YNGx6jlh5EIE3BSHicAQktgi0ekGD4+PLSkGC7Egzlw==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age19a7j77w267z04zls7m28a8hj4a0g5af6ltye2d5wypg33c3l89csd4r9zq" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWUWM3c0R1cEV5LzBsb3pV\nM2NEU0ZFRWhoOE9IZlgyU0hsVUtZM2JCcm1NClBlVXFVVUNZUXJVbElGWm5BQkJy\nWHY2Sm1GUWl2L0NOSXZiNlFjNGFCT28KLS0tIDVCSGREN2tjQmhYbGRINVF4WTA0\nSWVzL3EyVzJZSzlCdjJ0cG1mYmZ0cHcKnMs0Sl76ZYPKeUwgiX5FT9uFEOK4F1H1\n/ieM9hQwhEZqHpslLWWdNYbGShwEhC4cs22SUNutBWrYfD/MsKv0qA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l" } ], "lastmodified": "2026-01-07T09:18:20Z", diff --git a/modules/yggdrasil-wg/default.nix b/modules/yggdrasil-wg/default.nix index 8b190651..c17c8f08 100644 --- a/modules/yggdrasil-wg/default.nix +++ b/modules/yggdrasil-wg/default.nix @@ -48,33 +48,56 @@ let PersistentKeepalive = 25; family = "4"; } + { from = "skadhi"; + to = "surtr"; + endpointHost = "202.61.241.61"; + PersistentKeepalive = 25; + family = "4"; + } + { from = "skadhi"; + to = "surtr"; + endpointHost = "2a03:4000:52:ada::"; + PersistentKeepalive = 25; + family = "6"; + } + { from = "skadhi"; + to = "vidhar"; + endpointHost = "10.141.0.1"; + PersistentKeepalive = 25; + family = "4"; + } ]; wgHostIPs = mapAttrs (_family: wgSubnet: { surtr = "${wgSubnet}::/${toString wgHostLength}"; vidhar = "${wgSubnet}:1::/${toString wgHostLength}"; sif = "${wgSubnet}:2::/${toString wgHostLength}"; + skadhi = "${wgSubnet}:3::/${toString wgHostLength}"; }) wgSubnet; greHostMACPrefixes = { "4" = { surtr = "02:00:01:00:00"; vidhar = "02:00:01:00:01"; sif = "02:00:01:00:02"; + skadhi = "02:00:01:00:03"; }; "6" = { surtr = "02:00:02:00:00"; vidhar = "02:00:02:00:01"; sif = "02:00:02:00:02"; + skadhi = "02:00:02:00:03"; }; }; batHostMACs = { surtr = "02:00:00:00:00:00"; vidhar = "02:00:00:01:00:00"; sif = "02:00:00:02:00:00"; + skadhi = "02:00:00:03:00:00"; }; batHostIPs = { surtr = ["${batSubnet}::/${toString batHostLength}"]; vidhar = ["${batSubnet}:1::/${toString batHostLength}"]; sif = ["${batSubnet}:2::/${toString batHostLength}"]; + skadhi = ["${batSubnet}:3::/${toString batHostLength}"]; }; routers = [ "surtr" ]; diff --git a/modules/yggdrasil-wg/hosts/4/skadhi.priv b/modules/yggdrasil-wg/hosts/4/skadhi.priv new file mode 100644 index 00000000..dd66633f --- /dev/null +++ b/modules/yggdrasil-wg/hosts/4/skadhi.priv @@ -0,0 +1,18 @@ +{ + "data": "ENC[AES256_GCM,data:fXF8DV6vgpbJJWQvjIS3sFZ+yUEPtWwAZQrDLT8jueqDdn/IVaZGlq+DEnT0,iv:FU0ofu31RZlq2qMcMHlzYoRB61g+vwaG2JjPrKUgxYI=,tag:+dLvtiKmYdtk9NCXV8Yn9w==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQR25od0g4MGhLY2d0Y1Fx\nS3RGVE1UbTFEc1Qzakx0VFdDbWNTdnU1MXowCkxNMXJycGlEVFEvV1dtQ3B3WXVX\nRm12ZmZTUTd6WGtvQkNJQzlsTVF1RHcKLS0tIE9tMzIzWFlWNHdINTkrSmcwYVNT\nVEVzSWFjMWJLSmRPRmZlQ1ZVMktLQ28KAUOrlZCuSZwF7QkOSz1dQ4Uj2f8gvjtM\n3c4sXQ3P77Rqluijsxo9KQx7Q0lRGBaRPMY4IrnHNPogd8iOHPeZuA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArWmlPTWUrZ1QvYVBSckFL\nelZtcGdEMDBHeE5ROVdVdEJvWHpISzN3OVhjCkpSSTg2dDNqZjZYY0RyRlpuTi96\nS1l1dzJPV0NKbEJVdWpkTnZNZXJ0Qk0KLS0tIElBMmxJcmlxekVxRm1VdkgrSkNm\nZXhaMlhNdi9hVlNKaXU5MGVnK2NZWnMKjavFZczePCyYb2X4UsFNOaB5g+g1KZ52\npl+NTzRsUIXqPZnRDcCkGDjlQgLnZ+A22Enhbpj21ThiPV7bTyFh2g==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1u6xegt79rarmyz8qy4pl7jh9lh90vx8fg0frmh4u2mzam7zydq4s4agz4e" + } + ], + "lastmodified": "2026-09-24T04:46:17Z", + "mac": "ENC[AES256_GCM,data:cubfKvUaDE6XNb9Y/1dbXpwayRXoZjiM9T3dN+YVeS6/5WX+hMC7We6mdge5VBnZ9CjA3XXNy+ZP1DEaPSg1OsBq1ubnFuVbaRKZlFl1B4I+6e4xpsZdQiyZT3SFZoM/LI1oM6kxD8e1n7KjFWNRx3yqAMaK3z1Ko1AlAmkmDx8=,iv:ME5EYC/MvuFxY7es250VcW0z2x1tCInCPrZnr4mBjrw=,tag:Jfd3uEVibe6Iw/3uNc+UTQ==,type:str]", + "version": "3.13.3" + } +} diff --git a/modules/yggdrasil-wg/hosts/4/skadhi.pub b/modules/yggdrasil-wg/hosts/4/skadhi.pub new file mode 100644 index 00000000..a722609e --- /dev/null +++ b/modules/yggdrasil-wg/hosts/4/skadhi.pub @@ -0,0 +1 @@ +x5c5441ah63QZRbj+IV711Xv3JZOQYQON8Zo7rzU6i4= diff --git a/modules/yggdrasil-wg/hosts/6/skadhi.priv b/modules/yggdrasil-wg/hosts/6/skadhi.priv new file mode 100644 index 00000000..848cd299 --- /dev/null +++ b/modules/yggdrasil-wg/hosts/6/skadhi.priv @@ -0,0 +1,18 @@ +{ + "data": "ENC[AES256_GCM,data:lOitSuIg4Xjr5xycgaXBWkA79zySQOy+ZPXUxRjbU3F3/YHbcyrKYatVygdf,iv:8QcEXehosL/zUYxbNE284GfQHjz6HzBIyscigtNiDw8=,tag:eRINZKIv4UwprovUq7016Q==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLY2U0S2tUZHpXSjVoTk1m\nSWlXK0UyWm5SMGxBbUtHTFp1U3NadUliemlNCjArMHdJVk5BYzVSK0F5RGdMQU1E\nMEZuUkt3R29sdHZsRnFPaVhlUzVpaWcKLS0tIDFXOEpFOC94NlEzZnZqY2F6VERt\nc3lvZEt2b0tVU3pvMU5VR1dqYUtFbUEKcRVTIkz5bz47rAkihOTJLJPvA0mqabUM\nUr+zZjdrWTKqnWuEcJ93xsCKyo4kC1k/SkaXia65krhi9z4BVe5kgQ==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1rmmhetcmllq0ahl5qznlr0eya2zdxwl9h6y5wnl97d2wtyx5t99sm2u866" + }, + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRWUxYNXNXODAzb2daTC9Y\nSmtHRHUwZmRoaXhpTmpDbXZSMkkwMjI0Q2pnCi92RFgrK2pSTFdIL29wT09lVGZM\nTWxXamlSOVpOdXoxcSttSDNkUDJ1K0UKLS0tIC9rVnNXZWxhd2J3NGd2NkdUOUVO\nbE9ha1RyS3dOczNXa3pjVkh3bm5RS1kK4APdzi4AKkI7z5S2zpFkipkldVzeYO0Q\nGck0KtHhM8ZRTqJ9Q7WID2JwbAV5og3924SAYFbQvYdSd2zGqkD+Aw==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1u6xegt79rarmyz8qy4pl7jh9lh90vx8fg0frmh4u2mzam7zydq4s4agz4e" + } + ], + "lastmodified": "2026-09-24T04:46:30Z", + "mac": "ENC[AES256_GCM,data:5mgUxl7FQCgmCWL2SRtf7FOi5z64scb9Qt/rUwPMdenAuTG0ED3NVGOATTVoco7l0MBbs/D7OBKDMMvJ/Odgo0I9srRDyhXdrVbVKMphD1uXAwxPaK2iUeK3xz93Kzvr17UXzd7SwXTReokv/lIcFyDqUvlBXGWxZdYsc/rf4Us=,iv:50ByoxaHrl6qQbKoEEAgUIpYyhVhp47AYnagbH8n5kA=,tag:5KjE/A7EwiG/sSGpkkQBcg==,type:str]", + "version": "3.13.3" + } +} diff --git a/modules/yggdrasil-wg/hosts/6/skadhi.pub b/modules/yggdrasil-wg/hosts/6/skadhi.pub new file mode 100644 index 00000000..7a51045a --- /dev/null +++ b/modules/yggdrasil-wg/hosts/6/skadhi.pub @@ -0,0 +1 @@ +BtEGTPfLbtQJAAHfG/7jBissxcR/IfIRqeqhZG2dr0k= -- cgit v1.2.3