flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747793476,
+        "lastModified": 1747009742,
-        "narHash": "sha256-2qAOSixSrbb9l6MI+SI4zGineOzDcc2dgOOFK9Dx+IY=",
+        "narHash": "sha256-TNhbM7R45fpq2cdWzvFj+H5ZTcE//I5XSe78GFh0cDY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2468b2d35512d093aeb04972a1d8c20a0735793f",
+        "rev": "c74665abd6e4e37d3140e68885bc49a994ffa53c",
         "type": "github"
       },
       "original": {
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747663185,
+        "lastModified": 1742568034,
-        "narHash": "sha256-Obh50J+O9jhUM/FgXtI3he/QRNiV9+J53+l+RlKSaAk=",
+        "narHash": "sha256-QaMEhcnscfF2MqB7flZr+sLJMMYZPnvqO4NYf9B4G38=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "ee07ba0d36c38e9915c55d2ac5a8fb0f05f2afcc",
+        "rev": "42ee229088490e3777ed7d1162cb9e9d8c3dbb11",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1747744144,
+        "lastModified": 1746904237,
-        "narHash": "sha256-W7lqHp0qZiENCDwUZ5EX/lNhxjMdNapFnbErcbnP11Q=",
+        "narHash": "sha256-3e+AVBczosP5dCLQmMoMEogM57gmZ2qrVSrmq9aResQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2795c506fe8fb7b03c36ccb51f75b6df0ab2553f",
+        "rev": "d89fc19e405cb2d55ce7cc114356846a0ee5e956",
         "type": "github"
       },
       "original": {

flake.nix

@@ -82,6 +82,7 @@
         ];
         format = "proxmox";
       };
+    };
     vm-proxmox = let
       image = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
@@ -96,5 +97,4 @@
     in
       image.config.system.build.VMA;
   };
-  };
 }

hosts/Yura-PC/default.nix

@@ -32,7 +32,7 @@
 
   boot.loader.timeout = 3;
   boot.loader.systemd-boot.configurationLimit = 5;
-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_14;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_13;
 
   # https://nixos.wiki/wiki/Accelerated_Video_Playback
   hardware.graphics = {

hosts/router/default.nix

@@ -8,7 +8,6 @@ in
     [ # Include the results of the hardware scan.
       ./hardware-configuration.nix
       ./ifconfig.nix
-      ./wireguard.nix
       ./firewall.nix
       ./dns.nix
       ./kea.nix

hosts/router/secrets/wireguard/wg0-peer-AsusS513-psk.age

@@ -1,5 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 D2MY/A YAk0egMScFdPo0uAZzITtgQyPAifDcVUfb957Zhz9Ec
-pAEM+7sbPE8rHBhRV7mTmH1w4mbfKFopMWbwu/3KHCw
---- ykshsqEqKvCCE2kWIPAJPA/DFW7mu6+0x4MQhHgi1yU
-'ÈzÆ€{gÈid\{çEâ•Ätp¢U×g2QC3gßÈJGªV1Ð6·WG_E&»vŽó)°&òüñÞ‘N"§ƒ¯n©_TÍ’¸

hosts/router/secrets/wireguard/wg0-peer-Yura-TPX13-psk.age

@@ -1,6 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 D2MY/A P88M0uj4ZphVo3WrRYDu+c7B0Dl7ncctbYkByYmU2wg
-DV3Gn6TQ6iByAlNt0gg8kSZ2r0Gie/wcznZx9M+CC2g
---- KhwGM50BVql02Jq0do2uhXMfgWPPDfbodzDRmZ9n0O4
-r<EFBFBD>¸›Ô¶aõyY/C¡£JæB®Xº!ñ"F
-¿h‹­Ò(ñL>Œ()Üó»û<C2BB>òS;·}}2ОO.¯óhoqYðK"cˆEÛÕJM?-ËO

hosts/router/secrets/wireguard/wg0-private-key.age

@@ -1,5 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 D2MY/A tvRtTGWnaB0zxqZRba4/XpzwPa61RrnHCk4tT8OfnGQ
-IX85Q5VKxQTl+MnhzwiuTnNMVkR9QrYo/1njrbZeBnQ
---- dmlPIL2T+RFhbO2iLDRa4BxxYSSUQdedV3TK83ooFdA
-萭E	7搸0`d鑆(o赪饱籗@
傐瓩渿p瓥樼豘羳袃T砬枉禪堺+*齖Q嵗[龘巷xё29瞚5錵

hosts/router/services.nix

@@ -52,13 +52,13 @@ in
     };
   };
 
-  secrix.system.secrets.cf-api-key.encrypted.file = ./secrets/cf-api-key.age;
+  secrix.system.secrets.cf-api-key.encrypted.file = ../../secrets/cf_api_key.age;
   systemd.services.caddy.serviceConfig.EnvironmentFile = config.secrix.system.secrets.cf-api-key.decrypted.path;
   services.caddy = {
     enable = true;
     package = pkgs.caddy.withPlugins {
       plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-      hash = "sha256-Gsuo+ripJSgKSYOM9/yl6Kt/6BFCA6BuTDvPdteinAI=";
+      hash = "sha256-saKJatiBZ4775IV2C5JLOmZ4BwHKFtRZan94aS5pO90=";
     };
     virtualHosts."grouter.${domain}".extraConfig = ''
       encode

hosts/router/wireguard.nix

@@ -1,57 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  vars = import ./vars.nix;
-
-  wg0Peers = [
-    {
-      name = "Yura-TPX13";
-      allowedIPs = [ "10.6.0.3/32" "${vars.extra.opnsense.p6}::6:3:0/112" ];
-      publicKey = "iJa5JmJbMHNlbEluNwoB2Q8LyrPAfb7S/mluanMcI08=";
-      pskEnabled = true;
-    }
-    {
-      name = "Yura-Pixel7Pro";
-      allowedIPs = [ "10.6.0.4/32" "${vars.extra.opnsense.p6}::6:4:0/112" ];
-      publicKey = "UjZlsukmAsX60Z5FnZwKCSu141Gjj74+hBVT3TRhwT4=";
-      pskEnabled = true;
-    }
-    {
-      name = "AsusS513";
-      allowedIPs = [ "10.6.0.100/32" ];
-      publicKey = "XozJ7dHdJfkLORkCVxaB1VmvHEOAA285kRZcmzfPl38=";
-      pskEnabled = true;
-    }
-  ];
-in
-{
-  secrix.system.secrets = let
-    pskEnabledPeers = builtins.filter (peer: peer.pskEnabled) wg0Peers;
-    peerToSecretAttrs = peer: {
-      name = "wg0-peer-${peer.name}-psk";
-      value.encrypted.file = ./secrets/wireguard/wg0-peer-${peer.name}-psk.age;
-    };
-    peerSecretsList = map peerToSecretAttrs pskEnabledPeers;
-    peerSecrets = builtins.listToAttrs peerSecretsList;
-  in
-  {
-    wg0-private-key.encrypted.file = ./secrets/wireguard/wg0-private-key.age;
-  } // peerSecrets;
-
-  systemd.network.netdevs = {
-    "10-wg0" = {
-      netdevConfig = {
-        Kind = "wireguard";
-        Name = "wg0";
-      };
-      wireguardConfig = {
-        PrivateKeyFile = config.secrix.system.secrets.wg0-private-key.decrypted.path;
-        ListenPort = 18596;
-      };
-      wireguardPeers = map (peer: {
-        AllowedIPs = peer.allowedIPs;
-        PublicKey = peer.publicKey;
-        PresharedKeyFile = if peer.pskEnabled then config.secrix.system.secrets."wg0-peer-${peer.name}-psk".decrypted.path else null;
-      }) wg0Peers;
-    };
-  };
-}