wireguard: use new anemone key

hosts/anemone/default.nix

@@ -5,6 +5,7 @@
 
   nixpkgs.overlays = [ inputs.neovim-nightly.overlays.default ];
   age.secrets = {
+    wg_anemone.file = ../../secrets/wg_anemone.age;
     passwd.file = ../../secrets/passwd.age;
   };
 
@@ -26,6 +27,7 @@
     printing
     security
     snapper
+    wireguard
 
     ./filesystem.nix
     ./kernel.nix

hosts/dandelion/default.nix

@@ -5,6 +5,7 @@
 
   age.secrets = {
     acme_dns.file = ../../secrets/acme_dns.age;
+    wg_dandelion.file = ../../secrets/wg_dandelion.age;
   };
 
   imports = with modules.system; [
@@ -16,6 +17,7 @@
     nix-stable
     packages
     security
+    wireguard
 
     modules.services.nginx
     modules.services.postgres

modules/system/packages.nix

@@ -17,6 +17,7 @@
     neovim
     nfs-utils
     ntfs3g
+    oci-cli
     ripgrep
     rsync
     sshfs

modules/system/wireguard.nix

@@ -1,14 +1,12 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, gcSecrets, ... }:
 let
   port = 51820;
-  serverName = "sugarcane";
+  serverName = "dandelion";
-  serverInterface = "ens3";
+  serverInterface = "enp0s6";
-  serverIp = "51.79.240.130";
+  serverIp = gcSecrets.wireguard.gateway;
 
   forwarding = {
-    "80" = [ "10.100.0.2" "80" ];
+#    "22727" = [ "10.100.0.3" "7777" ];
-    "443" = [ "10.100.0.2" "443" ];
-    "22727" = [ "10.100.0.3" "7777" ];
   };
 
   mapForwards = type:
@@ -24,45 +22,39 @@ let
     );
 
   routeBypass = {
-    caramel = {
+    anemone = {
-      gateway = "192.168.100.1";
+      interface = "wlp1s0";
-      interface = "wlan0";
+      routes = [ serverIp ];
-      routes = [
-        serverIp
-      ];
     };
     hyacinth = {
-      gateway = "192.168.100.1";
       interface = "enp5s0";
-      routes = [
+      routes = [ serverIp ];
-        serverIp
-      ];
     };
   };
 
   clients = {
-    caramel = {
+    # caramel = {
-      publicKey = "VDqcpS0lJzFgwikj61MJ1xc9P8Cuq0NXa+Hc+etn2iA=";
+    #   publicKey = "VDqcpS0lJzFgwikj61MJ1xc9P8Cuq0NXa+Hc+etn2iA=";
-      allowedIPs = [ "10.100.0.2/32" ];
+    #   allowedIPs = [ "10.100.0.2/32" ];
-    };
+    # };
     hyacinth = {
       publicKey = "6nVhazYdmC15A/nke9VrqIg3sOBVOmqj4GEsyBq7MVo=";
-      allowedIPs = [ "10.100.0.3/32" ];
+      allowedIPs = [ "10.100.0.3/32" "${gcSecrets.wireguard.ipv6Subnet}:3"];
     };
-    strawberry = {
+    anemone = {
-      publicKey = "Fkcp/VSN4Dkhly8V4hskF4lnDviA7VZHCnWf7OliFCg=";
+      publicKey = "px5+JNdAmqBvUC++DhiJrUBRAr+BYP6iYVt4sbhPTWY=";
-      allowedIPs = [ "10.100.0.4/32" ];
+      allowedIPs = [ "10.100.0.4/32" "${gcSecrets.wireguard.ipv6Subnet}:4" ];
     };
-    maple = {
+    hibiscus = {
-      publicKey = "kPw8hpANygfz83Oi/l+iCVYalV2zfs7fhkccjoGG2Do=";
+      publicKey = "vQ5a2KMrwi7RCRsD0yvog+n35vQYFuvwiPn+W4lbRBw=";
-      allowedIPs = [ "10.100.0.5/32" ];
+      allowedIPs = [ "10.100.0.5/32" "${gcSecrets.wireguard.ipv6Subnet}:5" ];
     };
   };
 
   clientPeers = builtins.attrValues clients;
   serverPeer = {
     publicKey = "3ugIk2tQZXjAH9/95s63ld2WNUHQrd4Mz5jzbln6oj0=";
-    allowedIPs = [ "0.0.0.0/0" ];
+    allowedIPs = [ "0.0.0.0/0" "::/0" ];
     endpoint = "${serverIp}:${toString port}";
     persistentKeepalive = 25;
   };
@@ -79,7 +71,7 @@ let
     };
 
     wireguard.interfaces.wg0 = {
-      ips = [ "10.100.0.1/24" ];
+      ips = [ "10.100.0.1/24" "${gcSecrets.wireguard.ipv6Subnet}:1" ];
       listenPort = port;
 
       postSetup = ''
@@ -101,7 +93,7 @@ let
     let
       client = clients."${config.networking.hostName}";
       routes = routeBypass."${config.networking.hostName}";
-      mapRoutes = type: lib.concatMapStringsSep "\n" (r: "${pkgs.iproute2}/bin/ip route ${type} ${r} via ${routes.gateway} dev ${routes.interface}") routes.routes;
+      mapRoutes = type: lib.concatMapStringsSep "\n" (r: "${pkgs.iproute2}/bin/ip route ${type} ${r} via 192.168.1.1 dev ${routes.interface}") routes.routes;
     in {
       ips = client.allowedIPs;
       listenPort = port;
@@ -121,6 +113,10 @@ let
     };
   };
 in {
+  boot.kernel.sysctl = lib.mkIf (config.networking.hostName == serverName) ({
+    "net.ipv6.conf.all.forwarding" = true;
+    "net.ipv6.conf.default.forwarding" = true;
+  });
   networking =
     lib.mkMerge [
       (lib.mkIf (config.networking.hostName == serverName) serverConfig)

overlays/default.nix

@@ -5,6 +5,7 @@ builtins.map (path: import path) [
   ./ccache.nix
   ./eww.nix
   ./material-icons.nix
+  ./oci-cli.nix
   ./steam.nix
   ./utillinux.nix
   ./wpa-supplicant.nix

overlays/oci-cli.nix

@@ -0,0 +1,5 @@
+self: super: {
+  oci-cli = super.oci-cli.overrideAttrs(o: {
+    patches = (o.patches or []) ++ [ ./patches/oci.patch ];
+  });
+}

overlays/patches/oci.patch

@@ -0,0 +1,30 @@
+diff --git a/services/core/src/oci_cli_virtual_network/virtualnetwork_cli_extended.py b/services/core/src/oci_cli_virtual_network/virtualnetwork_cli_extended.py
+index 44562fd9780..ae426944a47 100644
+--- a/services/core/src/oci_cli_virtual_network/virtualnetwork_cli_extended.py
++++ b/services/core/src/oci_cli_virtual_network/virtualnetwork_cli_extended.py
+@@ -285,13 +285,13 @@ def unassign_private_ip(ctx, from_json, vnic_id, ip_address):
+     click.echo('Unassigned IP address {} from VNIC {}'.format(ip_address, vnic_id), err=True)
+ 
+ 
+-@cli_util.copy_params_from_generated_command(virtualnetwork_cli.create_ipv6, params_to_exclude=['wait_for_state', 'max_wait_seconds', 'wait_interval_seconds'])
++@cli_util.copy_params_from_generated_command(virtualnetwork_cli.create_ipv6, params_to_exclude=['wait_for_state', 'max_wait_seconds', 'wait_interval_seconds', 'subnet_id'])
+ @virtualnetwork_cli.vnic_group.command(name='assign-ipv6', help=virtualnetwork_cli.create_ipv6.help)
+ @cli_util.option('--unassign-if-already-assigned', is_flag=True, default=False, help="""Force reassignment of the IP address if it's already assigned to another VNIC in the subnet. This is only relevant if an IP address is associated with this command.""")
+ @click.pass_context
+ @json_skeleton_utils.json_skeleton_generation_handler(input_params_to_complex_types={'defined-tags': {'module': 'core', 'class': 'dict(str, dict(str, object))'}, 'freeform-tags': {'module': 'core', 'class': 'dict(str, string)'}}, output_type={'module': 'core', 'class': 'PrivateIp'})
+ @cli_util.wrap_exceptions
+-def assign_ipv6(ctx, from_json, vnic_id, defined_tags, display_name, freeform_tags, ip_address, unassign_if_already_assigned, ipv6_subnet_cidr, route_table_id):
++def assign_ipv6(ctx, from_json, vnic_id, defined_tags, display_name, freeform_tags, ip_address, unassign_if_already_assigned, ipv6_subnet_cidr, route_table_id, lifetime):
+     networking_client = cli_util.build_client('core', 'virtual_network', ctx)
+ 
+     # First we get the VNIC because we need to know the subnet OCID for the ListIpv6s call
+@@ -348,6 +348,9 @@ def assign_ipv6(ctx, from_json, vnic_id, defined_tags, display_name, freeform_ta
+     if route_table_id is not None:
+         assign_ip_request_body['routeTableId'] = route_table_id
+ 
++    if lifetime is not None:
++        assign_ip_request_body['lifetime'] = lifetime
++
+     # If we are here then either the IP address does not exist or it is a candidate to be moved
+     if not is_ip_reassignment:
+         if ip_address is not None:

secrets.nix

@@ -11,7 +11,8 @@ in {
 
   "secrets/acme_dns.age".publicKeys = [ dandelion hazel rin ];
   "secrets/warden_admin.age".publicKeys = [ rin ];
-  "secrets/wg_blossom.age".publicKeys = [ blossom rin ];
+  "secrets/wg_anemone.age".publicKeys = [ anemone rin ];
+  "secrets/wg_dandelion.age".publicKeys = [ dandelion rin ];
+  "secrets/wg_hyacinth.age".publicKeys = [ blossom rin ];
   "secrets/wg_caramel.age".publicKeys = [ rin ];
-  "secrets/wg_sugarcane.age".publicKeys = [ rin ];
 }

secrets/wg_blossom.age

@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 CUCjXQ hLTFE9rxZfhOZ2rELykmG54pxJMCjTkzBvLasvgSN24
-wDbW0X7bItmMEDfGRVAw+wHycHDI/2OYAb5jFyd8f6s
--> ssh-ed25519 U9FXlg juuKBMw9hX559zK6f2ERuBMl27ypQ6Ky5xlFEJxApXc
-Gb6/rTwqMINqiojoIWcFEAQCEuQ6bQQHrOXChkthb4A
---- OEQ8ALTXcJKvpf0rJe6x2VHSAsTi1yFhz3eU0CZDjqE
-<EFBFBD><EFBFBD><EFBFBD>ٓP<EFBFBD><EFBFBD>Θ~<7E>F<EFBFBD><46>d<EFBFBD>wi
 <20>]h<><68><EFBFBD><EFBFBD>//<2F><03>4<>ڰ<EFBFBD>N<EFBFBD><4E>7L<14><><EFBFBD>aQ=	<19>v@<40>oB<6F><42><EFBFBD><EFBFBD>*<2A>48 D=<3D>򪋅

secrets/wg_caramel.age

@@ -1,5 +1,6 @@
 age-encryption.org/v1
--> ssh-ed25519 U9FXlg qEy0vaHPPr9EUDjC3FveSk/xcnW/rtHVmx9o7cH7JFA
+-> ssh-ed25519 U9FXlg VpFnvpTVZFSkKRpEgcmuT/WDLIP1ZySFLq2lRvrjq20
-WAzEfa7T82vbkwMv/JIOASIjZ3gr1TRNfVzOWdWBVkQ
+7zQoSoIs1URmAYn2AdjvDTIY8GDYROcSxFq1bcl24Og
---- AoVNbcEOrFU5jcQ8geP5e4Lo3RxOyP9p4BG3BNsgiIQ
+--- iaQQUE1/Xj1vxto3d+Llyl6XGrSff5MGPxdCHW9EI40
-ÛÙ³Î'ºäÔXoüY÷ûÀfůŠ!Ãúá¡Êû/
Ù"p;<BZƒT{&luŸëíõ3³bõÃRÓ“rHï™­tä\ü½söÕòÁ´·
+»ò”ùßƦÅ`t‘Á	¶\š ó
+b<EFBFBD>žpeHøžºXÚ3à!‹$ë3]Xý32Öt~Ví.=Íâ>é$òxÞB×KJ¨AL:¢DDâ}5

secrets/wg_dandelion.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 bRFqeQ swv/p+w9+aytIkQ/6Yk1jouA+0M3rJabuiOz2rlpyAs
+wt+wnM1EEKAyDNefr9K4+DtZvHcOzz9Y1EBRFkA5Nv4
+-> ssh-ed25519 U9FXlg xxV/8JoorO4YWPbwSG7p306Pb2+aT10u9eNR69PhZAA
+rjOOuapa/h1tMYbdOc3Y/fPPzkNcYiamSk6rS/tbhtE
+--- UKvt/4aAyYHOk5bhAP55yxPhkxTE94/xEqIqpGF3yiE
+ŠãÞÕ5;_±E<C2B1>DBé<kÔJ~‹<>&ªTD›¤z`/=t¯½É²¨؈°ºéÒ;<07>yà)°ì%’LÙ•J*@£Ì
cx<;ñ¹ko˜ˆ

secrets/wg_hyacinth.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 CUCjXQ ptHKlNvz+AmnB/Wt9XBBNyfOGeoPG5TbyrXv5993PDQ
+P0C17K+Kz8ocn0vzLf02aaYnxvRM/yjfRLMsBaJhsok
+-> ssh-ed25519 U9FXlg /M8ryJjXAdlWhvNHbQgKUxe/UtL7HqEs9RqNDQBW3SM
+p2d9OnOkU2Hx7+Kn+Z66qElFvczd3F4zVm5KXbOzYWY
+--- PVd8mrRk/t6qv/U32/AZk9YssRU1yn3CLPeyaEPBXi0
+Ôíš:ÙDx[cyyÛ™c4×É¥À/Þ‡^›.¼·=÷†‹È¯oöG›VQdXf<>©ò^È@TRe<52>Åæˆgœ½<C593>nøÀÆÖ9UTØ	

secrets/wg_sugarcane.age

@@ -1,5 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 U9FXlg 7YXsTcRa8pco9Ic9fDSygCjNXrxFi5pHADtUqwOBPhg
-0BYvRAhcQQ36kAXOW2QaS4S9rhenUx8xwbNozNdDpLM
---- V1E/2n1Ae5hlWhjAEziHA2J072a20GeKM+EtG+pT8cI
-ÿúº÷ºçª´zW‰„ôTþŠì¢¾¢G³{ݨ¢"’Þ\Ê–s<E28093>ËâeÜ>®…æÈúîü¦%õÌ)o|z™!Ä“©×–2ࢨE¢sÐ