diff --git a/darwin/default.nix b/darwin/default.nix index f9d250f..f7109da 100644 --- a/darwin/default.nix +++ b/darwin/default.nix @@ -8,6 +8,7 @@ ./settings.nix ./homebrew.nix ./yabai.nix + ./wireguard.nix ]; # nix config diff --git a/darwin/wireguard.nix b/darwin/wireguard.nix new file mode 100644 index 0000000..1c523df --- /dev/null +++ b/darwin/wireguard.nix @@ -0,0 +1,40 @@ +{ + config, + pkgs, + hostName, + ... +}: +{ + sops.secrets."wireguard/${hostName}" = { + mode = "0400"; + }; + + launchd.daemons.wireguard = { + script = '' + set -e + mkdir -p /etc/wireguard + PRIVATE_KEY=$(cat ${config.sops.secrets."wireguard/${hostName}".path}) + cat > /etc/wireguard/wg0.conf << EOF + [Interface] + Address = $WG_IP + PrivateKey = $PRIVATE_KEY + + [Peer] + PublicKey = NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs= + Endpoint = 178.254.8.35:51820 + AllowedIPs = 10.10.0.0/24 + PersistentKeepalive = 25 + EOF + chmod 600 /etc/wireguard/wg0.conf + ${pkgs.wireguard-tools}/bin/wg-quick up wg0 + ''; + environment.WG_IP = ""; + serviceConfig = { + Label = "org.wireguard.wg0"; + RunAtLoad = true; + KeepAlive = false; + StandardOutPath = "/var/log/wireguard.log"; + StandardErrorPath = "/var/log/wireguard.log"; + }; + }; +} diff --git a/hosts/cyper-controller/configuration.nix b/hosts/cyper-controller/configuration.nix index 7887e7f..70153a9 100644 --- a/hosts/cyper-controller/configuration.nix +++ b/hosts/cyper-controller/configuration.nix @@ -22,6 +22,17 @@ useNetworkd = true; useDHCP = false; firewall.enable = true; + wireguard.interfaces.wg0 = { + ips = [ "10.10.0.2/24" ]; + peers = [ + { + publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs="; + endpoint = "178.254.8.35:51820"; + allowedIPs = [ "10.10.0.0/24" ]; + persistentKeepalive = 25; + } + ]; + }; }; systemd.network = { diff --git a/hosts/cyper-desktop/configuration.nix b/hosts/cyper-desktop/configuration.nix index eaa616d..47cd87a 100644 --- a/hosts/cyper-desktop/configuration.nix +++ b/hosts/cyper-desktop/configuration.nix @@ -6,6 +6,17 @@ useNetworkd = true; useDHCP = false; firewall.enable = true; + wireguard.interfaces.wg0 = { + ips = [ "10.10.0.40/24" ]; + peers = [ + { + publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs="; + endpoint = "178.254.8.35:51820"; + allowedIPs = [ "10.10.0.0/24" ]; + persistentKeepalive = 25; + } + ]; + }; }; systemd.network = { diff --git a/hosts/cyper-mac/configuration.nix b/hosts/cyper-mac/configuration.nix index c915eb0..ee8e9e8 100644 --- a/hosts/cyper-mac/configuration.nix +++ b/hosts/cyper-mac/configuration.nix @@ -1 +1,3 @@ -{ ... }: { } +{ + launchd.daemons.wireguard.environment.WG_IP = "10.10.0.3/24"; +} diff --git a/hosts/cyper-node-1/configuration.nix b/hosts/cyper-node-1/configuration.nix index 53c8f6b..7e0dc5e 100644 --- a/hosts/cyper-node-1/configuration.nix +++ b/hosts/cyper-node-1/configuration.nix @@ -8,6 +8,17 @@ useNetworkd = true; useDHCP = false; firewall.enable = true; + wireguard.interfaces.wg0 = { + ips = [ "10.10.0.30/24" ]; + peers = [ + { + publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs="; + endpoint = "178.254.8.35:51820"; + allowedIPs = [ "10.10.0.0/24" ]; + persistentKeepalive = 25; + } + ]; + }; }; systemd.network = { diff --git a/hosts/cyper-node-2/configuration.nix b/hosts/cyper-node-2/configuration.nix index 39789ba..7ea2471 100644 --- a/hosts/cyper-node-2/configuration.nix +++ b/hosts/cyper-node-2/configuration.nix @@ -8,6 +8,17 @@ useNetworkd = true; useDHCP = false; firewall.enable = true; + wireguard.interfaces.wg0 = { + ips = [ "10.10.0.31/24" ]; + peers = [ + { + publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs="; + endpoint = "178.254.8.35:51820"; + allowedIPs = [ "10.10.0.0/24" ]; + persistentKeepalive = 25; + } + ]; + }; }; systemd.network = { diff --git a/hosts/cyper-proxy/configuration.nix b/hosts/cyper-proxy/configuration.nix index 8283e34..1882e0f 100644 --- a/hosts/cyper-proxy/configuration.nix +++ b/hosts/cyper-proxy/configuration.nix @@ -37,9 +37,37 @@ "178.254.16.141" ]; + wireguard.interfaces.wg0 = { + ips = [ "10.10.0.1/24" ]; + listenPort = 51820; + peers = [ + { + publicKey = "EvML4de3CReNW8aF+lJAsPZ+p6FICOyjCsAZJBwIwX8="; + allowedIPs = [ "10.10.0.2/32" ]; + } + { + publicKey = "WkY45tGnNZQuJTf1MPN6I92spxHts/kpzXRSZE9se2c="; + allowedIPs = [ "10.10.0.3/32" ]; + } + { + publicKey = "oAstNd7Wxpj2PqSyS87q+8y8WtaLK7hZ5Ytfncml9EM="; + allowedIPs = [ "10.10.0.40/32" ]; + } + { + publicKey = "GrFH3I5QqjRij7Jl+eOL6Ou6zK6MtH5/kAsA5AmGckM="; + allowedIPs = [ "10.10.0.30/32" ]; + } + { + publicKey = "IddGAijZVCVxGj/aMasjfroIy9r8Owar4MO9xfvNNBY="; + allowedIPs = [ "10.10.0.31/32" ]; + } + ]; + }; + firewall.allowedTCPPorts = [ 80 443 + 51820 ]; hosts = { diff --git a/hosts/cyper-proxy/hardware-configuration.nix b/hosts/cyper-proxy/hardware-configuration.nix index a3c9403..3293959 100644 --- a/hosts/cyper-proxy/hardware-configuration.nix +++ b/hosts/cyper-proxy/hardware-configuration.nix @@ -16,6 +16,7 @@ ]; kernelModules = [ ]; }; + kernel.sysctl."net.ipv4.ip_forward" = 1; kernelModules = [ ]; extraModulePackages = [ ]; }; @@ -30,10 +31,9 @@ "mode=755" ]; }; + + "/nix".neededForBoot = true; + "/persist".neededForBoot = true; }; - - fileSystems."/nix".neededForBoot = true; - fileSystems."/persist".neededForBoot = true; - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; } diff --git a/nixos/default.nix b/nixos/default.nix index 43e0e53..f8eb434 100644 --- a/nixos/default.nix +++ b/nixos/default.nix @@ -11,7 +11,7 @@ imports = [ ./sops.nix ./locale.nix - ./tailscale.nix + ./wireguard.nix ./ssh.nix ./impermanence.nix ] diff --git a/nixos/tailscale.nix b/nixos/tailscale.nix deleted file mode 100644 index e19834c..0000000 --- a/nixos/tailscale.nix +++ /dev/null @@ -1,10 +0,0 @@ -{ config, ... }: -{ - sops.secrets.tailscale_auth_key = { }; - - services.tailscale = { - enable = true; - openFirewall = true; - authKeyFile = config.sops.secrets.tailscale_auth_key.path; - }; -} diff --git a/nixos/wireguard.nix b/nixos/wireguard.nix new file mode 100644 index 0000000..2332104 --- /dev/null +++ b/nixos/wireguard.nix @@ -0,0 +1,14 @@ +{ config, hostName, ... }: +{ + sops.secrets."wireguard/${hostName}" = { + mode = "0400"; + }; + + networking = { + wireguard.interfaces.wg0 = { + privateKeyFile = config.sops.secrets."wireguard/${hostName}".path; + }; + firewall.allowedUDPPorts = [ 51820 ]; + }; + +} diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml index 819bfe4..558deb6 100644 --- a/secrets/secrets.yaml +++ b/secrets/secrets.yaml @@ -35,6 +35,13 @@ ssh_private_key: ENC[AES256_GCM,data:R511mVFVk1ogAd5CKk/2P6rtT4NnHIFfKyqeCen545Q ssh_github_key: ENC[AES256_GCM,data:vZAH4cRDsgGXLAppQKOyUPOvmBJZ27bujMGz4hQ8tt0xhGFUP28llwGZz/VRuU02Yv4alLgVWBAIPuyhZT9f35KnjIR1Mmb7HXk/6oaNM59/lBiISLrnOpC10WmJ9O5krKdxwP8ZDvHA34B0s+oYNkTNXiU0S8AVg3icploax7ylKH5Dorj53kjdYSTjd8KN6ZsgCKmcz97+GnP0IgdmauyNL7e+kv9WIfE8Xx1kGvC8WVnidX2YhSxm6vt8l60eUj9etRigU88oFYTDZ+mIf4lucSpzaLZutz2fM/16D/o9SS7mmTrEllj2S+IXc9ZZTRKKDLbW+yv0XUi0XZi+OHAdZScjS54NZKyT9uWrc/IDJHammGsoHRQpHZtbGhkeFi/KdJsYBsWItslXjM0xJVtFIM2tMnd10kv9UGuXsSl9J4NC0rpz3aXnQqG4ZAhMjN9D/DTJpB4K0pcFyd2FDWdrbKq5iPfnU/V6ecnHPML6wCt6gua/LdK1MWoG3l2SqwMLYj1r7UW5fQZqSw1EK0BAtp9cQMLBL/2w8ykMfWpLekE=,iv:gcinU7xOoXQkFVkLNB3sQYHAcZy3pZN+bDRIq4sspys=,tag:yawgAHBKIkGpnKPHsRId4g==,type:str] nix_cache_priv_key: ENC[AES256_GCM,data:FbRHM4n7BDMDgZYtTOdpS0SQx80afxMC3uw6PtdKb1zcAjyQRYwJe0esTDLklLDh8Kx6dgZOJbrf2sYIzF5xVv09U1Uz0C1UnF4M6yhbg+Nqg0HfVj55L3Z6ulrxNlgq7gY=,iv:F9DZUsyzZocKoB0yByeBcrCw9Ytcp+Xk6y8+ZH4OV7k=,tag:mSf1zVciPkifzr3kVFAt0g==,type:str] tailscale_auth_key: ENC[AES256_GCM,data:jJU2WKuiYTLcYyoCXeBMpc/mmjOH6JupIofo5CQbs0bGcnBrv3wNtmI2TR2dqdyohx9d7DJUkjrIgi2OWRI=,iv:zWPqc7cErVZaI6vRbSbPrcEKZmKCoEsDKhnjKTlgsJA=,tag:TLwUzfyyKnmOuWdpTG7Uow==,type:str] +wireguard: + cyper-proxy: ENC[AES256_GCM,data:ohe1JLavTPpEcQl+EGPcmJodBn6KaLf7S7aCLrHEgROklcX28Yjm1m4uW0Q=,iv:4iEO3ay0sqaRUxsqR3P7XFpbD6mnnq73yNsZbT22iGU=,tag:HwQaId/xi6OF99z9bZf6ew==,type:str] + cyper-desktop: ENC[AES256_GCM,data:pABywoxw/BURnpwCfsvXD7jmN+fa6NyHmJIKpR6pkTUNHE2h1xsD64M54JE=,iv:UcDWk1ULbbxBDad/MDD94Iaj2bB/xlpLWtsuPTP6E7c=,tag:La/PWVzumCusn9IaAFkxwQ==,type:str] + cyper-controller: ENC[AES256_GCM,data:q85Tw7GGuoMlsRPDlPJ0n3aUw3cOejmjDwxSBr6Jkw+L7ZAU9yz7vthIpho=,iv:CdHhEqAOBMqsa3ZWD2RIoTlyObBpnUQhdZncmq8u7W0=,tag:tCYXugIb7rQDkgwRsY023Q==,type:str] + cyper-node-1: ENC[AES256_GCM,data:+Des2tr8Fja0IarMmn6xc2bjYIlwfoVmdXMRC8yyenIrke+SS09/VV8ed/A=,iv:xL6gxjur1FNDtziNP/bEGyUXZ9VD9wmxHmWb6BR3xig=,tag:RGLuXGMAJSaREE9b9RnnfA==,type:str] + cyper-node-2: ENC[AES256_GCM,data:0vjNM8xgHXQtKDeKD6NBYjn3jpt9NMsLgaxZOzb9wgg1HTeLjwhK7Xw12Co=,iv:CETgdC0nKP5n8XMZj++bXWUY/harcJu+wj3S3ksLE0U=,tag:6EHF7DWi0ruKjJht1ndWcA==,type:str] + cyper-mac: ENC[AES256_GCM,data:8MSy7ALUwYyk42CpIuiym4L3VIn0MSyxr0M1Gz+t/hAwzNdvWQkYUZirZ+Q=,iv:eUbXRhhR3/ZQGJE/Uf0bISWx1YeOuPqhhMBo4CwF23w=,tag:mgfXWrEWyS3AsvlA6EJq8g==,type:str] sops: age: - enc: | @@ -46,7 +53,7 @@ sops: 6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w== -----END AGE ENCRYPTED FILE----- recipient: age10pyhca0jy75wtqv5hrn0gf0jcam5272zx9h73a8xwwaxyfq89c0qs5dr9t - lastmodified: "2026-06-28T21:28:16Z" - mac: ENC[AES256_GCM,data:PTeAIxRx+TWjvLrIrh5KHsxRtIIMJxXQIb1b3Q50Kx11toNnijmrjIRjPgrT//D+9KMyTqJCXK8mZ3VFW/658fawsxbfLQuOyVP2XI2vl77Cc+aZDDTsCrHZkcMn1VHZuoPRqZP4yZm9H8RkAqtdLg1WB7WTcJso3MiDWf9tBRk=,iv:qPRtIyUFE1xuficyrfmSua9CvuU1IYZmCtcaXOQeXkg=,tag:ZrEbRsVjyVHMLYuuYAcGzw==,type:str] + lastmodified: "2026-06-29T09:16:03Z" + mac: ENC[AES256_GCM,data:IN9vRP9kYa/KRo2R6A/g2azBLOj/twoX4NY88iT9JG092QVeeSmvgDoQ+heb0b8rBcfFbEtVFZkGZkjr9eUBfp2gaFw1j958PahH/Mm03R++SSoYr29yHlPkBuWUkQzhUv4vQ8nQQvueY8U9FmFEUoP6uV+MBhYkhUyAsONWGZk=,iv:H6zeAUndn98wTGs1elTVPkLJDYbm/n5l5wdD9HBU8qU=,tag:PAYt8w3X/6o+z3h3NHINRA==,type:str] unencrypted_suffix: _unencrypted version: 3.13.1