commit 9199ef069ba828749579170f921277326d5d05c0
parent 570c320397a4f052050ebf34c08cff06ea2fcfe9
Author: Silas Brack <silasbrack@gmail.com>
Date: Sun, 13 Oct 2024 16:51:18 +0200
Major changes, things working
Diffstat:
14 files changed, 32 insertions(+), 431 deletions(-)
diff --git a/apps/my_app/module.nix b/apps/my_app/module.nix
@@ -12,6 +12,10 @@ in {
services.myapp = {
enable = mkEnableOption "My App";
+ package = mkOption {
+ defaultText = lib.literalMD "`packages.default` from the my_app flake";
+ };
+
environment = mkOption {
type = types.enum [ "dev" "prod" ];
default = "dev";
@@ -45,13 +49,13 @@ in {
group = cfg.user;
description = "My app service user";
isSystemUser = true;
- # createHome = false;
- createHome = true;
- packages = with pkgs; [
- gleam
- erlang_27
- rebar3
- ];
+ createHome = false;
+ # createHome = true;
+ # packages = with pkgs; [
+ # gleam
+ # erlang_27
+ # rebar3
+ # ];
};
systemd.services = {
@@ -74,18 +78,21 @@ in {
# # '';
# };
- pokemon-app = {
+ my_app = {
wantedBy = [ "multi-user.target" ];
- description = "Run Pokemon app.";
+ description = "Run my app.";
after = [ "network.target" ];
# after = [ "clone-pokemon-app" ];
# requires = [ "clone-pokemon-app" ];
serviceConfig = {
Type = "simple";
User = cfg.user;
- ExecStart = "/home/${cfg.user}/pokemon-app/erlang-shipment/entrypoint.sh run";
+ ExecStart = "${cfg.package}/bin/my_app";
+ };
+ environment = {
+ PORT = builtins.toString cfg.port;
};
- path = with pkgs; [ gleam erlang_27 rebar3 ];
+ # path = with pkgs; [ gleam erlang_27 rebar3 ];
};
# postgres-migration = {
diff --git a/apps/my_app/src/my_app.gleam b/apps/my_app/src/my_app.gleam
@@ -1,5 +1,6 @@
import gleam/erlang/process
import mist
+import my_app/env
import my_app/router
import wisp
import wisp/wisp_mist
@@ -12,12 +13,14 @@ pub fn main() {
// Here we generate a secret key, but in a real application you would want to
// load this from somewhere so that it is not regenerated on every restart.
let secret_key_base = wisp.random_string(64)
+ let env = env.get_env()
// Start the Mist web server.
let assert Ok(_) =
wisp_mist.handler(router.handle_request, secret_key_base)
|> mist.new
- |> mist.port(8003)
+ |> mist.bind("0.0.0.0")
+ |> mist.port(env.port)
|> mist.start_http
// The web server runs in new Erlang process, so put this one to sleep while
diff --git a/apps/my_app/src/my_app/router.gleam b/apps/my_app/src/my_app/router.gleam
@@ -9,8 +9,11 @@ pub fn handle_request(req: Request) -> Response {
use _req <- web.middleware(req)
// Later we'll use templates, but for now a string will do.
- let body = string_builder.from_string("<h1>Hello, Joe!</h1>")
+ let body = string_builder.from_string("<h1>Hello, Silas!</h1>")
// Return a 200 OK response with the body and a HTML content type.
wisp.html_response(body, 200)
+ // wisp.response(200)
+ // |> wisp.set_header("Content-Type", "text/html")
+ // |> wisp.html_body(body)
}
diff --git a/flake.lock b/flake.lock
@@ -26,7 +26,7 @@
},
"locked": {
"lastModified": 1,
- "narHash": "sha256-RirvqSHmEsPsi8MubQ2b+zWJoirpUooEcJrKZ9HMX/A=",
+ "narHash": "sha256-j8bSHeeUjQT6X76t2O5np+cDMgxezME7YDkvV5mHnSQ=",
"path": "./apps/my_app",
"type": "path"
},
diff --git a/flake.nix b/flake.nix
@@ -57,6 +57,7 @@
imports = [
./vpn.nix
sops-nix.nixosModules.sops
+ ./apps/my_app/module.nix
];
# security.pki.certificates = [ (builtins.readFile "/run/secrets/ca_certificate") ];
@@ -87,49 +88,10 @@
];
};
- # services.myapp = {
- # enable = true;
- # port = 8000;
- # };
-
- networking.firewall.allowedTCPPorts = [ 8000 8003 8004 ];
- users.groups.myapp_user = {};
- users.users.myapp_user = {
- name = "myapp_user";
- group = "myapp_user";
- description = "My app service user";
- isSystemUser = true;
- createHome = true;
- packages = with pkgs; [
- gleam
- erlang_27
- rebar3
- ];
- };
- # systemd.services.pokemon-app = {
- # wantedBy = [ "multi-user.target" ];
- # description = "Run Pokemon app.";
- # after = [ "network.target" ];
- # serviceConfig = {
- # Type = "simple";
- # User = "myapp_user";
- # ExecStart = "/home/myapp_user/pokemon-app/erlang-shipment/entrypoint.sh run";
- # };
- # path = with pkgs; [ gleam erlang_27 rebar3 ];
- # };
- systemd.services.my_app = {
- wantedBy = [ "multi-user.target" ];
- description = "Run my app.";
- after = [ "network.target" ];
- serviceConfig = {
- Type = "simple";
- User = "myapp_user";
- ExecStart = "${my_app.packages."x86_64-linux".default}/bin/my_app";
- };
- environment = {
- PORT="8004";
- };
- # path = with pkgs; [ my_app.packages."x86_64-linux".default gleam erlang_27 rebar3 ];
+ services.myapp = {
+ enable = true;
+ package = my_app.packages."x86_64-linux".default;
+ port = 8009;
};
# services.postgres = {
diff --git a/infrastructure/.gitignore b/infrastructure/.gitignore
@@ -1,3 +0,0 @@
-result
-/secrets/
-
diff --git a/infrastructure/.sops.yaml b/infrastructure/.sops.yaml
@@ -1,13 +0,0 @@
-keys:
- - &users:
- - &desktop age1s29qgfupgx7mqn9dk2rndp6xh63f5qan8vqa77ve603wd5m9a9rqkpq7re
- - &thinkpad age10h669gfc0yfdrfj4gtnsrpdfvrsh55tn0cj8kuk5t3x5e079dpgs30cuxw
- - &hosts:
- - &server age1e52v0cr69sycuh59hksx9nk5327vgkemkxqwngd25gtztxhkpups87yd5g
-creation_rules:
- - path_regex: secrets.yaml
- key_groups:
- - age:
- - *desktop
- - *thinkpad
- - *server
diff --git a/infrastructure/Makefile b/infrastructure/Makefile
@@ -1,78 +0,0 @@
-SHELL := /bin/sh
-
-## Create public & private wireguard keys to add a new device to the VPN.
-add-to-vpn:
- @read -p "Enter device name: " DEVICE && \
- umask 077 && \
- wg genkey > ./secrets/wireguard-keys/$$DEVICE.private && \
- wg pubkey < ./secrets/wireguard-keys/$$DEVICE.private > ./secrets/wireguard-keys/$$DEVICE.public && \
- echo "Successfully saved keys for device $$DEVICE to ./secrets/wireguard-keys/"
-
-## Deploy changes to hive.nix to DigitalOcean droplets.
-deploy:
- colmena apply
-
-## Build a NixOS image to upload to DigitalOcean.
-image:
- nix-build image.nix
-
-#################################################################################
-# Self Documenting Commands #
-#################################################################################
-
-.DEFAULT_GOAL := help
-
-# Inspired by <http://marmelab.com/blog/2016/02/29/auto-documented-makefile.html>
-# sed script explained:
-# /^##/:
-# * save line in hold space
-# * purge line
-# * Loop:
-# * append newline + line to hold space
-# * go to next line
-# * if line starts with doc comment, strip comment character off and loop
-# * remove target prerequisites
-# * append hold space (+ newline) to line
-# * replace newline plus comments by `---`
-# * print line
-# Separate expressions are necessary because labels cannot be delimited by
-# semicolon; see <http://stackoverflow.com/a/11799865/1968>
-.PHONY: help
-help:
- @echo "$$(tput bold)Available rules:$$(tput sgr0)"
- @echo
- @sed -n -e "/^## / { \
- h; \
- s/.*//; \
- :doc" \
- -e "H; \
- n; \
- s/^## //; \
- t doc" \
- -e "s/:.*//; \
- G; \
- s/\\n## /---/; \
- s/\\n/ /g; \
- p; \
- }" ${MAKEFILE_LIST} \
- | LC_ALL='C' sort --ignore-case \
- | awk -F '---' \
- -v ncol=$$(tput cols) \
- -v indent=19 \
- -v col_on="$$(tput setaf 6)" \
- -v col_off="$$(tput sgr0)" \
- '{ \
- printf "%s%*s%s ", col_on, -indent, $$1, col_off; \
- n = split($$2, words, " "); \
- line_length = ncol - indent; \
- for (i = 1; i <= n; i++) { \
- line_length -= length(words[i]) + 1; \
- if (line_length <= 0) { \
- line_length = ncol - indent - length(words[i]) - 1; \
- printf "\n%*s ", -indent, " "; \
- } \
- printf "%s ", words[i]; \
- } \
- printf "\n"; \
- }' \
- | more $(shell test $(shell uname) = Darwin && echo '--no-init --raw-control-chars')
diff --git a/infrastructure/README.md b/infrastructure/README.md
@@ -1,71 +0,0 @@
-# Infrastructure
-
-```
-.
-├── hive.nix <- Primary colmena NixOS server cluster configuration
-├── image.nix <- Raw NixOS image used to generate an OS image with `nix-build`
-├── Makefile <- Contains common commands that you will be running
-├── secrets.yaml <- Contains encrypted secrets to be used and updated by sops
-├── shell.nix <- Defines the development environment which can be accessed via `nix-shell`
-└── vpn.nix <- Imported by hive.nix; configures the VPN setup
-```
-
-## SOPS
-
-## Adding a New Key
-1. Run `sops secrets.yaml`
-2. Add a key-value pair to the file, e.g., `my_secret_key: iaj0t8r34u5r8924hrj2`
-3. Add the key definition to `hive.nix`, e.g., `sops.secrets.my_secret_key = {};`
-4. The secret can be accessed at the `/run/secrets/my_secret_key` file on the server
-
-## Adding a New Machine
-
-## Adding a New Machine to the VPN
-1. Generate a private Wireguard key with `wg genkey > ~/.wireguard.private`
-2. Generate a public Wireguard key with `wg pubkey < ~/.wireguard.private`
-3. Copy the value of the outputted public key, then add a new attribute set in `vpn.nix` under `peers`, i.e. (with `X` autoincrementing),
-
- ```nix
- { # {{your device name}}
- publicKey = "{{your public key}}";
- allowedIPs = [ "10.100.0.{{X}}/32" ];
- }
- ```
-4. (Option A, if device is using NixOS) Add the following to your `configuration.nix`:
-
- ```nix
- networking.firewall = {
- allowedUDPPorts = [ 10232 ];
- };
- networking.wg-quick.interfaces = {
- wg0 = {
- address = [ "10.100.0.{{X}}/24" ];
- dns = [ "10.100.0.1" ];
- listenPort = 10232;
- # autostart = false; # Optional, if you don't want the VPN to start automatically
- privateKeyFile = "/home/silas/.wireguard.private";
- peers = [
- {
- publicKey = "2jWfr5UmACvuS+0HOfSNgEUYqoqVNnfVDoaatmgEykw=";
- allowedIPs = [ "0.0.0.0/0" ];
- endpoint = "188.166.127.72:51820";
- persistentKeepalive = 25;
- }
- ];
- };
- };
- ```
-4. (Option B, if not using NixOS) Install Wireguard, then add the following to your Wireguard configuration:
-
- ```
- [Interface]
- ListenPort = 10232
- PrivateKey = {{your private key}}
-
- [Peer]
- PublicKey = 2jWfr5UmACvuS+0HOfSNgEUYqoqVNnfVDoaatmgEykw=
- AllowedIPs = 0.0.0.0/0
- Endpoint = 188.166.127.72:51820
- PersistentKeepalive = 25
- ```
-
diff --git a/infrastructure/hive.nix b/infrastructure/hive.nix
@@ -1,95 +0,0 @@
-let
- nixos_24_05 = builtins.fetchTarball {
- name = "nixos-24.05";
- url = "https://github.com/nixos/nixpkgs/archive/63dacb46bf939521bdc93981b4cbb7ecb58427a0.tar.gz";
- sha256 = "1lr1h35prqkd1mkmzriwlpvxcb34kmhc9dnr48gkm8hh089hifmx";
- };
- sops_nix = "${builtins.fetchTarball {
- url = "https://github.com/Mic92/sops-nix/archive/3198a242e547939c5e659353551b0668ec150268.tar.gz";
- sha256 = "0b7x86lvjfkxpxnf2dl7mf8rvsyhsn0xjmgaw8m58286191wp3lb";
- }}/modules/sops";
-
-in {
- meta = {
- nixpkgs = (import nixos_24_05) {};
- };
-
- defaults = { pkgs, ... }: {
- system.stateVersion = "24.05"; # Do not change lightly!
- environment.systemPackages = with pkgs; [
- vim wget curl rsync rclone zip unzip
- ];
- services.openssh.enable = true;
- networking.firewall.allowedTCPPorts = [ 80 ];
-
- boot.loader.grub = {
- enable = false;
- };
- fileSystems."/" = {
- device = "/dev/sda1";
- fsType = "ext4";
- };
- };
-
- nixos-s-1vcpu-512mb-10gb-ams3-01 = { pkgs, name, ... }: {
- deployment = {
- targetHost = "188.166.127.72";
- targetUser = "root";
- };
- networking.hostName = name;
- time.timeZone = "Europe/Amsterdam";
-
- imports = [
- ./vpn.nix
- sops_nix
- # ../apps/my-app/module.nix
- ];
- # security.pki.certificates = [ (builtins.readFile "/run/secrets/ca_certificate") ];
-
- sops.defaultSopsFile = ./secrets.yaml;
- sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
- sops.secrets.server_wireguard_key = {
- restartUnits = [ "wg-quick-wg0.service" ];
- };
- sops.secrets.ca_certificate = {};
-
- users.users.silas = {
- isNormalUser = true;
- description = "Silas Brack";
- home = "/home/silas";
- extraGroups = [ "networkmanager" "wheel" ]; # "keys"
- openssh.authorizedKeys.keys = [
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPYO29H4+yDvJbaoUqTg5V6IpD3CMFlB2F47MCzHNpY silasbrack@gmail.com" # Thinkpad
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGqHJMc2SCzL50SO9Flfnhn012p1dmp4Iph8lPQ2aoe/ silasbrack@gmail.com" # Desktop
- ];
- packages = with pkgs; [
- neovim
- gleam
- erlang_27
- rebar3
- ];
- };
-
- # services.myapp = {
- # enable = true;
- # port = 8000;
- # };
-
- # services.postgres = {
- # enable = true;
- # };
-
- services.nginx = {
- enable = true;
- virtualHosts."localhost" = {
- locations."/" = {
- return = "200 'Hello, NixOS!'";
- extraConfig = ''
- default_type text/plain;
- '';
- };
- };
- };
-
- };
-}
diff --git a/infrastructure/image.nix b/infrastructure/image.nix
@@ -1,6 +0,0 @@
-{ pkgs ? import <nixpkgs> { } }:
-let config = {
- imports = [ <nixpkgs/nixos/modules/virtualisation/digital-ocean-image.nix> ];
-};
-in
-(pkgs.nixos config).digitalOceanImage
diff --git a/infrastructure/secrets.yaml b/infrastructure/secrets.yaml
@@ -1,40 +0,0 @@
-server_wireguard_key: ENC[AES256_GCM,data:21uPlSLnedqeXxIjS+HhJ0lAD6T/diIkjAAhbrB/a6jSVST9u8YTXWNgZ8w=,iv:pOGONrRuUNS8obDdw6GvEkCO7a+Ym5kOgLH6u+P9QQ0=,tag:cAcDTQ5pU8fV5hDzx+d+5A==,type:str]
-ca_certificate: ENC[AES256_GCM,data:NPIus6BbTwTIDS/xpBwHuZIN9yqASucABgQNZmCOML+NKRjTSsSCw6t2ulRoSIuyKvXF48yyCzmVHvqpWizy6UAHfcJML9HztIKdoC8NjNviBEI53D8vmpntoMkqCL9HjCmoPJuPstTRw3DEuhlQjsaBXsQLEqmNmFGoa1lagVkNrIakHfNavD0Sd/Y97m0PthkCcY8Iru1QZYa99mo5YmVz0osTG0c1vr8In6wHA6zPuM7ThmuRia7nwrR/vtskKg42w4TSa7V53QHPabKDr+kyM5KTMMEHqI2HLdx3ac6az6MtadBWsDGj+smpKLpxVpFCvDwrs+xS5aoU140h249TwGSRtOajPYvX5J1/X2u/8wLF9Sfv/IB7wxzd66rqSs5q3EuV8Iw9qOuzO+Rleh5ApahYj401HYj9oankR9RBO2tL3hI2x0Ozn3JMMwQThNYZO2Wysl9z+4Vb5Xt9ndIqvU5OJN2TKj8L5KV1BoBj6rpI5XxSwIn0Ng2yyNpym/dl3eej2nXBtwYdL2grUSIoD3tCjMlsZ8OXFp9GHJ/NHa/zsAIl0geb+VpeYwaRJyRYzyhAYKLTl4mWRiEPaQx46Tt/YJVB1uwBY0RNVavWIXES0LCvs9QeLRizQl0dWlt1FdMC5mhE/1lhoscfF1Zudv5j86omEX9hALOcNWaBPk4WXaDC3tSCggW85HUAiU0agiEnuRD01PQlce45m31ck/d6umKUVdTHsiSzAOzGAU45uLWZS1BWIh0y5E48JsOEI0uy4MyCDcqct5fjr7N22Lnvc6C+H9xRJRgRlf7JH2WqezFT1wHgoVz9Ua5z/AbUWfVzmIY4fbTB8u7opKzC7eRJP+UHi/wXHMDQj86ySrPzWnP3WDUYbRSjeama8kZM/RFdzcDgsOCFd5gAnbn+rjOD6+Tmbts5V50VB6dhX1tQJcvl8dL5PDcLY6QoC1GzKUefASRs2tz7uAFwNFiRZSgAm9hYNU0rOKWXqhiBzgnTHpnnE/723NJGd6o4xT1vs+h7K23v0ZufJ+rbxDdMuwU9blXEsxQvHX93Xt903v+Os//L7bs9ZmQYa/i/b5j+vqzEZgI6Aqf7++9/OQoIPEvMaDY0qmOUb9F8ebGkgIo9184Zkx8sGQTMosCiAS4gt+kCo/+ZwgKvdc7leQs90EeG+hjcSP2rjILoPTD+EUqvknuCWWHZ3rPIGSKNOgs7Ph1IGbFU97mI3YiDuM8fdbyjm0G0L9x1llbZOSkaM3Sk4vsmv2v0zTdKxKihrvFXstWCMHZlpbDTSU6WtLCv1fMf3WNDiaK5S1iFumV/me/qWAcCet5NpOrSTva0eJdUrqE9SC+ljXVYEpQpsnKeyydAy6g+PTbQiQKyU7tHzyTlPzy3d7XsTAaHHEXPWNs8XOqJ/LeZBqoAPTnGZXTEgZjLqkosj1XsANGAO9uxLgokra2aW/jOEFCsreIlOk9Cb3TwUupcAVxDtg3vjFBf+PGTFXGqTXFvpfsXTKZ7R7CViP5+Q6Y+esp6be0ceFYbezIX3z/vTMVa2u1JiibHrJTepiCgz4YwY13UlyaLZpGAFyEO+ymvtXEWipyoSvz+DlMpHN+97TX18//Q0YLjSqiLJ61TbAnnsJ/Ozc7ACcLrEtDMZ1m1KrlN0SCx+0ECu/eYIjmbga9Qm4TERb52Gv/osZiz4HRUZb4zLumAAITukufQtnXL+026EG48jokwq9bTeD6SrsaYx/6czgC0EFEXGE+c26iPs0YdikeUSHoVg2QWlTwoBeABicJx/mvt+46HnaBu2yWbTrHAXeQo/g8jvNWW/01w2ue+gOT7anKnPqA3O2tc9tX1hOvmHAsFNMxQZyDMAyGwshy+fCvyzNwbvZmarMbDWwZgt3w8UgxWIccdyHaqfiGbO0v62RP000d207n78YexMpXTtsfC6vfvCjS4EgZX5BVg9UdWfHasz3dA1O48XZCohiCk/6slhSe5IqJjrEZo3bvFI+BXc6Jhmzto8CHcVLZr3nXkL0X4OWfL2SSfwjfW8uz+rA==,iv:VQYKe9GilKIRqDEVWKZtls1k+CfaEi8YhdXVKb9nh78=,tag:d4OYBzgyKA5KDkj9gz9CXg==,type:str]
-sops:
- kms: []
- gcp_kms: []
- azure_kv: []
- hc_vault: []
- age:
- - recipient: age1s29qgfupgx7mqn9dk2rndp6xh63f5qan8vqa77ve603wd5m9a9rqkpq7re
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTXRaUkNqVWpVY2NEdGo4
- QUNxbW41VWN3Mkx3NDRqbld0NlMyME5SRjJzCmEyZnVrWnRCcnoxbWE2bXFPQ1pk
- ME81VTIxMlluTW0rYmlHS0tlK1NONk0KLS0tIEhZN1BIdnk4dHRkY3JyTmthZjR6
- aDFtMXJPbzhxYU1RaGVyUjYvc3Z2YUUKHh8Y5iuPB8D0VOxZvXQX61Uoae525ajZ
- vc21qI0li9fBTmKNy0VYHDLvboP83jLNsAMd2To+xHmJimkhiivkew==
- -----END AGE ENCRYPTED FILE-----
- - recipient: age10h669gfc0yfdrfj4gtnsrpdfvrsh55tn0cj8kuk5t3x5e079dpgs30cuxw
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBNzNQMkorTkdISUJScUdr
- SW9qUjJNU2hvbmhJRTQ3MG1sY1QxUWNVZ0YwCnpTS0FRKzZpbWpyOEpPMlFCQlhw
- NmVVazNhZHBYdEFnMS9JT0Y2WUo1OTgKLS0tIEJ0Y3huYXJzY3poRkhTeXlOTXRv
- MTFtYnh5Y0ZXMzdhV3ZqUjVLQjAzN0UKEFfu1TlRUHkyGDg2PLWQdm0VfXUiGZDZ
- u5UsCR6bmvAMblGg4bXLmXhH61H97n6aJMS92j+G8uE4BDE1q/y4Tw==
- -----END AGE ENCRYPTED FILE-----
- - recipient: age1e52v0cr69sycuh59hksx9nk5327vgkemkxqwngd25gtztxhkpups87yd5g
- enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5Um1lQ0tVcGh0ZUQ2TGUv
- OG1Qck9iZ0JodkVPNGUwNCt5ZzI2NGxhQ1VvCmF1SmpNL2o5WlQrdTRYSTV0WUY2
- Um5hVUp4ODFLUWx4ckl4WlMxUEhYWEkKLS0tIFBBRWlDWlEvR3g3alY5emNaRVI4
- VTVIMjJSaGVRY3hYbmhzUmFiaCtxVUEKmGFgyEVxF0s8UqrbV9vpVonzEqMdx/9z
- yeAc9I9fdMiakISPvkh9Jkexc4duFS1noGTIAXPfCEriIupol2MVvw==
- -----END AGE ENCRYPTED FILE-----
- lastmodified: "2024-10-04T13:22:15Z"
- mac: ENC[AES256_GCM,data:8iW4SK8nAwaqfSr/FMebDZlF+8oUzu1YdK7sMoLCUEtYsuXCkjtHos9PAbayxmy5Mn3HipeJoqnkgPF9e0KDcvG2iwhIGTilheFx0qHvWz67cY5WdH0ykKVTbo1Kzcn3fhy/jzEzEYW1/hIPmrxZ82fA2jDMl9voSrVBgF6Rwg8=,iv:X7u4QwwXf54sK3bOtxQ6wgiswZF12zhNwhfsc0z2758=,tag:kS0SNx7YqUjWODoURDSpIg==,type:str]
- pgp: []
- unencrypted_suffix: _unencrypted
- version: 3.9.0
diff --git a/infrastructure/shell.nix b/infrastructure/shell.nix
@@ -1,5 +0,0 @@
-{ pkgs ? import <nixpkgs> { } }:
-pkgs.mkShell {
- buildInputs = with pkgs; [ curl colmena wireguard-tools sops ];
-}
-
diff --git a/infrastructure/vpn.nix b/infrastructure/vpn.nix
@@ -1,63 +0,0 @@
-{ pkgs, ... }:
-
-{
- networking.nat = {
- enable = true;
- externalInterface = "eth0";
- internalInterfaces = [ "wg0" ];
- };
- # Port 53 for DNS, port 51820 for WireGuard
- networking.firewall = {
- allowedTCPPorts = [ 53 ];
- allowedUDPPorts = [ 53 51820 ];
- };
- # boot.kernel.sysctl = {
- # # "net.ipv4.ip_forward" = lib.mkOverride 98 true;
- # "net.ipv4.conf.all.forwarding" = lib.mkOverride 98 true;
- # "net.ipv4.conf.default.forwarding" = lib.mkOverride 98 true;
- # };
- services.dnsmasq = {
- enable = true;
- extraConfig = ''
- interface=wg0
- '';
- };
- networking.wg-quick.interfaces = {
- wg0 = {
- address = [ "10.100.0.1/24" ];
- listenPort = 51820;
- privateKeyFile = "/run/secrets/server_wireguard_key";
-
- postUp = ''
- ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o eth0 -j ACCEPT
- ${pkgs.iptables}/bin/iptables -A FORWARD -o wg0 -i eth0 -j ACCEPT
- ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.1/24 -j MASQUERADE
- '';
- preDown = ''
- ${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -o eth0 -j ACCEPT
- ${pkgs.iptables}/bin/iptables -D FORWARD -o wg0 -i eth0 -j ACCEPT
- ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.1/24 -j MASQUERADE
- '';
-
- peers = [
- { # Thinkpad
- publicKey = "3owbBawNk7IEI8sHmJjr+Wna7QH5WxYuRGjU+OP4i2M=";
- allowedIPs = [ "10.100.0.2/32" ];
- }
- { # Pixel
- publicKey = "pTuUtRphmXYKhwInaCIQY7nXRgftNzgKJxleACutrFc=";
- allowedIPs = [ "10.100.0.3/32" ];
- }
- { # Desktop
- publicKey = "F/UODKJ2SQaRUOb7my2LtvRaN4p/khfW8bstO+09/zo=";
- allowedIPs = [ "10.100.0.4/32" ];
- }
- { # iPad
- publicKey = "KwQo8pMz0JYHaEV3sbezmpD8jwgbXjaumIKeqWYaeiE=";
- allowedIPs = [ "10.100.0.5/32" ];
- }
- ];
- };
- };
-}
-
