From e9210d4adad866000a0b7e60eb95bb085c2d9e76 Mon Sep 17 00:00:00 2001 From: clerie Date: Tue, 15 Apr 2025 20:55:56 +0200 Subject: [PATCH] hosts/backup-4,hosts/palladium: Setup direct VPN tunnel for backups --- hosts/backup-4/configuration.nix | 1 + hosts/backup-4/secrets.json | 7 +++--- hosts/backup-4/wg-b-palladium.nix | 40 ++++++++++++++++++++++++++++++ hosts/palladium/configuration.nix | 2 ++ hosts/palladium/secrets.json | 5 ++-- hosts/palladium/wg-b-palladium.nix | 38 ++++++++++++++++++++++++++++ 6 files changed, 88 insertions(+), 5 deletions(-) create mode 100644 hosts/backup-4/wg-b-palladium.nix create mode 100644 hosts/palladium/wg-b-palladium.nix diff --git a/hosts/backup-4/configuration.nix b/hosts/backup-4/configuration.nix index 443220a..7efe930 100644 --- a/hosts/backup-4/configuration.nix +++ b/hosts/backup-4/configuration.nix @@ -7,6 +7,7 @@ ./backup.nix ./restic-server.nix + ./wg-b-palladium.nix ]; profiles.clerie.mercury-vm.enable = true; diff --git a/hosts/backup-4/secrets.json b/hosts/backup-4/secrets.json index 8887d2e..ecadada 100644 --- a/hosts/backup-4/secrets.json +++ b/hosts/backup-4/secrets.json @@ -1,5 +1,6 @@ { "restic-server-magenta-htpasswd": "ENC[AES256_GCM,data:gfvmAd7z+jQwoYDJf/Hv2sR9ISJT+Hw4jrHmvW64PXjoETy+LjdsmqEPuRyq/YhrGA2rqW+YodPlkh/eE4crdTL2eNim+ij/OUubliUwBMyJuxsdGKuDUMc+txqN2x6Q24MnnU88P08SKpsm3jciMhz7JEg62W77jhesWlkzsuJDmg9oTlA9SeYOEac3pIKpekfRyE77GSFVUflwwCA+xvcEg5xyuRosFzBWGGEC3kDNB0licF0X6epz3HtlqhCLd/mkuEkftjpkNOFm9oJYzdwYv5PwVNg7G7JOgsUx9e5I29mwWPfhinX1yEFNwxKeB1FbUhYOKhRhdqWD6THVLkDzU0zP8vrm5FXTaxLHZr5+EpKit8/MJS5UBVvpSTDQ0cLExJyonWP2T+zr6rxKwU/q1jQRvsU6DJ7Bt8+9chrXBNOeyPM9xzWN1Zyyrntm9j5Ufj1YFwyrDT5ve2rOgNHA4KoS28+vsP1fcVO8XlLR24zFx5+/1BPG25qSECTPn6KkcL+yV+WS4oOnu4Oo0GVPEz+4SfyYIEVmaV61KC61pKa/6ACeUd6nABcDbReMqPXU7/bksM4sTDoFSmmiAycnxT4xavbaFdfbYIOXVQwYAIjaR1tAqQ6gYVCQ/LtKhIHCGCg10xRXNV3qkPqOUvJ7JnRcre+pQVDVLg==,iv:tvhvTPzhHoG4yG3C+o9s8yh4DafMpPb67nNxbUZcFxQ=,tag:8P5lYeP2EB5AfKgeeBISLg==,type:str]", + "wg-b-palladium": "ENC[AES256_GCM,data:XTenrGQFLDndt/XPaDGRLQthVq1UFKJ2mWK3Z+YfT54YpnWO81cslrMMtPc=,iv:tW8NHOcNj3Q26BJBIz7UPR3bmw3nrb0UkkD+gqngw/w=,tag:XDYkIqj6z2Jvhaoiqeyn0g==,type:str]", "wg-monitoring": "ENC[AES256_GCM,data:lCuE2EgUo3ER9NNg1rD24Z4cZS+VZ4KmDojnfCsb/LyBsfyu6uOJ4IVtxOE=,iv:KHRP1pXYXk8Fi23cjUZVUUadu9yWoJ2ddxj2fMJJYE0=,tag:TiFlekXM7WLLHAPlmYbP8w==,type:str]", "sops": { "kms": null, @@ -12,8 +13,8 @@ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpdFREUEVzb2JFd3hSaG9y\neVA2a2Fodko0OTI4ZGM0NlZxRmNtYmFDY1hVCm9ncXdWYTJlSU1FSG1WdlNBZ3VW\nM2VtRmZiWldzalRsRWJ0UkV1L1hSMkEKLS0tIGVLQU9kQXhZbC9SUW9CS2JnWGlJ\nQ3RoeXVkRXNkUWNaZ0VQOW1hcEJnNjAKHgZ48PERJlfkkh2TyCLl52zUZY674BXW\n4zPtmhZrb4xlExetINrOd4hZtL7S7qn5GnTxhoxvCddeU+JPPsfWoQ==\n-----END AGE ENCRYPTED FILE-----\n" } ], - "lastmodified": "2025-02-16T18:13:41Z", - "mac": "ENC[AES256_GCM,data:O+E3UbWbmlbpUPeSS/BFcJpWr2WEXbu0aaj9u3XUwstp4ba6e0xuVdzfbntQwbN378sDNpDMkAuxp1+R/0THBSs+nqXC9q9IgK+hfSBd7q2v4lvdhxRdM1x4wysTDJGtjFNdfz8EzqMz42Y2IWjxSozgPNpjZSIGhwMBA2TS/gU=,iv:1waH/yUGt5jGJbQlYmp5b97NGVyRykgzI2g1xX+Jo/U=,tag:4bxFxkClt3LbqCH552XePw==,type:str]", + "lastmodified": "2025-04-15T18:44:05Z", + "mac": "ENC[AES256_GCM,data:re/vIg7xa9fEBZM3xa/jZzsAutHHNgDNnHiGjXkR5W0ORYPjlBuSV5NYZTbr7y1rqWbjmPsbo1KjJgt8OF8kn1XxXaUprWYOtHh7NtyhMFUL+mgftRvdLeacZfcnTnOm95GNLR7sG1/qsMHQf+JmUU0fNEX/a/EmDXY2GTYzJ6o=,iv:9RY4yMrGxuVdfWOCL/hlZznHrfeWPEc1V5neZgS4g+Q=,tag:mfVGmPvnJa+XqmBnfIu6DA==,type:str]", "pgp": [ { "created_at": "2024-05-04T12:30:52Z", @@ -22,6 +23,6 @@ } ], "unencrypted_suffix": "_unencrypted", - "version": "3.8.1" + "version": "3.9.4" } } \ No newline at end of file diff --git a/hosts/backup-4/wg-b-palladium.nix b/hosts/backup-4/wg-b-palladium.nix new file mode 100644 index 0000000..78defc0 --- /dev/null +++ b/hosts/backup-4/wg-b-palladium.nix @@ -0,0 +1,40 @@ +{ config, ... }: + +{ + + sops = { + secrets.wg-b-palladium = { + owner = "systemd-network"; + group = "systemd-network"; + }; + }; + + systemd.network.netdevs."10-wg-b-palladium" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg-b-palladium"; + }; + wireguardConfig = { + PrivateKeyFile = config.sops.secrets.wg-b-palladium.path; + ListenPort = 51844; + }; + wireguardPeers = [ + { + PublicKey = "YMTOhRAKWfFX1UVBoROPvgcQxTSN4tny35brAocdnwo="; + AllowedIPs = [ "fd90:37fd:ddec:d921::/64" ]; + PersistentKeepalive = 25; + } + ]; + }; + + systemd.network.networks."10-wg-b-palladium" = { + matchConfig.Name = "wg-b-palladium"; + address = [ + "fd90:37fd:ddec:d921::1/64" + ]; + linkConfig.RequiredForOnline = "no"; + }; + + networking.firewall.allowedUDPPorts = [ 51844 ]; + +} diff --git a/hosts/palladium/configuration.nix b/hosts/palladium/configuration.nix index ee85ffe..1f0a22d 100644 --- a/hosts/palladium/configuration.nix +++ b/hosts/palladium/configuration.nix @@ -4,6 +4,8 @@ imports = [ ./hardware-configuration.nix + + ./wg-b-palladium.nix ]; boot.kernelParams = [ "console=ttyS0,115200n8" ]; diff --git a/hosts/palladium/secrets.json b/hosts/palladium/secrets.json index 76107cd..2fe2012 100644 --- a/hosts/palladium/secrets.json +++ b/hosts/palladium/secrets.json @@ -1,4 +1,5 @@ { + "wg-b-palladium": "ENC[AES256_GCM,data:VBDyrDYwICbiND8jfkiIr/3oDtP1X9817WhonFYXNSTPZHziEY7U886/DFc=,iv:syqo77FROChv4WKgiGWCUa2ziH2Ds14CT5vVRxGmEvQ=,tag:X2G3JUrabXYmsKPBltOafw==,type:str]", "wg-clerie": "ENC[AES256_GCM,data:fLGZCRbnDrSWQ+9Q/7l3DUKOgw7blcHpd8svHMZFEKMoTfGeZCc37oKAOKU=,iv:GlPXkeVnzSzAnpdSGIydZP+hhEshJ3X/N1fhwJk5Ol4=,tag:0E9RhBPha0Gun6KUNtvYUg==,type:str]", "wg-monitoring": "ENC[AES256_GCM,data:3RHk/VI8t9ba/qiWqLkwIxaOt+e0yXw7+f1qpIVdr3JE2NzkVvX6aeP3o2Q=,iv:f4VIK1oyaUilCia1EfEiL18a3zk4+7Ol4ihyhzPounw=,tag:XeTI3iL4qIPS+Z+PDJRGrA==,type:str]", "sops": { @@ -12,8 +13,8 @@ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpY3p1Mi85WTNxK2U5bFVP\ncmlFRXNlK2dWMUt1eW1abzIrb0liR043VHpnClIvaHZ1VWxRSFR3ajc0MmJyMFAw\nSWdVclB2OGJqUjNXTmI4MktXVTVQbncKLS0tIFpJTTZJRmJGeE1xNFFScE81R29J\nR3MzOGY1cVhmalNEaHdyWjkyaHVRTDAKXyz/+WdHsC2AppYNf3/W1xx2Zcfg4p50\nCAamBntNMUK8zYLdhoSBT54qVYJJuYZ6eD6WOIZrdCK4HKGy0d13uw==\n-----END AGE ENCRYPTED FILE-----\n" } ], - "lastmodified": "2025-04-15T17:54:41Z", - "mac": "ENC[AES256_GCM,data:fNxeNhsgF2UXmTI3pxlbFocsGAgwLF6GzQnndG00cx/8TC54eYzW1OaIjrBQzB6ARf6ocZ14rhd+PLqKhXuUZ3md77ojZOBxcT3P4yyMuQjRBYydPonBw0mseAiBtsKacqJSFCaC91JMSY2Y5wTwBiiCz5V9FbpmLLLlEEVrW1Q=,iv:4uPkvUEtNRowe2QTiuvAwOqR8PDfxbHlYoml9Cqdacg=,tag:J+8PnSEevmnvah9LVCTwsA==,type:str]", + "lastmodified": "2025-04-15T18:43:12Z", + "mac": "ENC[AES256_GCM,data:qcMFYqFrxzM8BNGuSeDZWJI/NVadvzIjGM2WF54cV5ty5O4iqb1Q0qOQBQMBVqYNO5BrQ2JeTXl2foLE1WncFY3JSg2v/Q8m1Kh1vFE2FbwYPh5bLGizI20JpBkqx0dMK8r4gvzaHwx2Cth7IWTGw/qGeO1wb4RWDh2E7xBlKRA=,iv:klutWxyHHhngjya93Sv3Tim69ozRuJdCsosMnn7pcYs=,tag:2w0okYEH8tzjJiODjxOHKw==,type:str]", "pgp": [ { "created_at": "2025-04-15T17:32:56Z", diff --git a/hosts/palladium/wg-b-palladium.nix b/hosts/palladium/wg-b-palladium.nix new file mode 100644 index 0000000..44f2910 --- /dev/null +++ b/hosts/palladium/wg-b-palladium.nix @@ -0,0 +1,38 @@ +{ config, ... }: + +{ + + sops = { + secrets.wg-b-palladium = { + owner = "systemd-network"; + group = "systemd-network"; + }; + }; + + systemd.network.netdevs."10-wg-b-palladium" = { + netdevConfig = { + Kind = "wireguard"; + Name = "wg-b-palladium"; + }; + wireguardConfig = { + PrivateKeyFile = config.sops.secrets.wg-b-palladium.path; + }; + wireguardPeers = [ + { + PublicKey = "VstE42L1SmZCIShH5sOqcpVQOV0Xb9cFgljD0lhvKFQ="; + AllowedIPs = [ "fd90:37fd:ddec:d921::/64" ]; + PersistentKeepalive = 25; + Endpoint = "backup-4.net.clerie.de:51844"; + } + ]; + }; + + systemd.network.networks."10-wg-b-palladium" = { + matchConfig.Name = "wg-b-palladium"; + address = [ + "fd90:37fd:ddec:d921::2/64" + ]; + linkConfig.RequiredForOnline = "no"; + }; + +}