home: refactor to support slightly different pc/laptop configs

.gitignore

@@ -1,5 +0,0 @@
-### Nix template
-# Ignore build outputs from performing a nix-build or `nix build` command
-result
-result-*
-

hosts/common-desktop.nix

@@ -114,7 +114,6 @@
     ripgrep-all
     rustscan
     whois
-    wireguard-tools
     yt-dlp
   ] ++ [
     bitwarden-desktop

hosts/router/default.nix

@@ -8,7 +8,6 @@ in
     [ # Include the results of the hardware scan.
       ./hardware-configuration.nix
       ./ifconfig.nix
-      ./wireguard.nix
       ./firewall.nix
       ./dns.nix
       ./kea.nix
@@ -78,7 +77,6 @@ in
     transcrypt
     waypipe
     whois
-    wireguard-tools
   ];
 
   # This value determines the NixOS release from which the default

hosts/router/firewall.nix

@@ -13,7 +13,6 @@ let
         ${ifs.lan30.name},
         ${ifs.lan40.name},
         ${ifs.lan50.name},
-        ${ifs.wg0.name},
     }
     define OPNSENSE_NET6 = ${vars.extra.opnsense.net6}
     define ZONE_LAN_EXTRA_NET6 = {
@@ -86,10 +85,8 @@ in
     family = "inet";
     content = ''
       ${nftIdentifiers}
-      define ALLOWED_TCP_PORTS = { ssh }
+      define ALLOWED_TCP_PORTS = { ssh, https }
-      define ALLOWED_UDP_PORTS = { ${toString vars.ifs.wg0.listenPort} }
+      define ALLOWED_UDP_PORTS = { bootps, dhcpv6-server, domain, https }
-      define ALLOWED_TCP_LAN_PORTS = { ssh, https }
-      define ALLOWED_UDP_LAN_PORTS = { bootps, dhcpv6-server, domain, https }
       set port_forward_v6 {
           type inet_proto . ipv6_addr . inet_service
           elements = {
@@ -136,10 +133,6 @@ in
           # but apparently not.
           ip6 daddr { fe80::/10, ff02::/16 } th dport { dhcpv6-client, dhcpv6-server } accept
 
-          # Global input rules
-          tcp dport $ALLOWED_TCP_PORTS accept
-          udp dport $ALLOWED_UDP_PORTS accept
-
           # WAN zone input rules
           iifname $ZONE_WAN_IFS jump zone_wan_input
           # LAN zone input rules
@@ -164,7 +157,8 @@ in
       }
 
       chain zone_wan_input {
-          # Allow specific stuff from WAN
+          # Allow SSH from WAN (if needed)
+          tcp dport ssh accept
       }
 
       chain zone_wan_forward {
@@ -186,8 +180,8 @@ in
           ip protocol icmp accept
 
           # Allow specific services from LAN
-          tcp dport $ALLOWED_TCP_LAN_PORTS accept
+          tcp dport $ALLOWED_TCP_PORTS accept
-          udp dport $ALLOWED_UDP_LAN_PORTS accept
+          udp dport $ALLOWED_UDP_PORTS accept
       }
 
       chain zone_lan_forward {

hosts/router/ifconfig.nix

@@ -83,7 +83,7 @@ in
       ia_pd 30/${ifs.lan30.net6} -
       ia_pd 40/${ifs.lan40.net6} -
       ia_pd 50/${ifs.lan50.net6} -
-      ia_pd 100/${pdFromWan}9::/64 -  # for vpn stuff
+      # ia_pd 7 -
       # ia_pd 8 -
 
       # the leases can be assigned to the interfaces,

hosts/router/secrets/wireguard/wg0-peer-Yura-TPX13-psk.age

@@ -1,5 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 D2MY/A cRVo1AetNYKsb28kGpe6mVpoCyfNcRibeBYhJuXbbEY
-k8XL4XEv4FM6sfU/TOFTg4vlKm61409No/TpCEjTnSk
---- mT9w1vnx2FrzWw+Zt1wV6UJ+mjHTizrUPVeaTisYQ74
-=<3D>q-So<><6F>pn<70><6E><EFBFBD><EFBFBD><EFBFBD>I<EFBFBD><49><EFBFBD>Z֠i<D6A0>'<27><><EFBFBD>"%M<><06><>C&

hosts/router/secrets/wireguard/wg0-private-key.age

@@ -1,5 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 D2MY/A Xg7XTl/qJqVqvXsHNKcoICq74DeOlquN1CEn1PwxlVY
-FqmPdDgmuUrwZPLW56RhW8o1VXr5l2Xms6IVebpi7bA
---- nLT/bC55EvoXK6f7DYbMhD3I8Z122bxeGVw1PCds2IM
-!<><7F><05>Dl<44><6C><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<3B><>KXq8<71>4<EFBFBD><34><EFBFBD><EFBFBD>+b<><62>p_q4B<34><42>'8<>%<25>cI<63><49>D<EFBFBD>t<><0C><05>V~;v*<2A><>W<EFBFBD>-<2D>,[<5B>tݑ<74>

hosts/router/services.nix

@@ -52,7 +52,7 @@ in
     };
   };
 
-  secrix.system.secrets.cf-api-key.encrypted.file = ./secrets/cf-api-key.age;
+  secrix.system.secrets.cf-api-key.encrypted.file = ../../secrets/cf_api_key.age;
   systemd.services.caddy.serviceConfig.EnvironmentFile = config.secrix.system.secrets.cf-api-key.decrypted.path;
   services.caddy = {
     enable = true;

hosts/router/vars.nix

@@ -5,11 +5,8 @@ let
     name_,
     domain_,
     p4_,  # /24
-    p4Size_ ? 24,
     p6_,  # /64
-    p6Size_ ? 64,
     ulaPrefix_,  # /64
-    ulaSize_ ? 64,
     token? 1,
     ip6Token_? "::${toString token}",
     ulaToken_? "::${toString token}",
@@ -17,18 +14,18 @@ let
       name = name_;
       domain = domain_;
       p4 = p4_;
-      p4Size = p4Size_;
+      p4Size = 24;
       net4 = "${p4}.0/${toString p4Size}";
       addr4 = "${p4}.${toString token}";
       addr4Sized = "${addr4}/${toString p4Size}";
       p6 = p6_;
-      p6Size = p6Size_;
+      p6Size = 64;
       net6 = "${p6}::/${toString p6Size}";
       ip6Token = ip6Token_;
       addr6 = "${p6}${ip6Token}";
       addr6Sized = "${addr6}/${toString p6Size}";
       ulaPrefix = ulaPrefix_;
-      ulaSize = ulaSize_;
+      ulaSize = 64;
       ulaNet = "${ulaPrefix}::/${toString ulaSize}";
       ulaToken = ulaToken_;
       ulaAddr = "${ulaPrefix}${ulaToken}";
@@ -100,17 +97,6 @@ rec {
       p6_ = "${pdFromWan}a";             # ::/64
       ulaPrefix_ = "${ulaPrefix}:0050";  # ::/64
     };
-    wg0 = mkIfConfig {
-      name_ = "wg0";
-      domain_ = "wg0.${ldomain}";
-      p4_ = "10.18.16";  # .0/24
-      p6_ = "${pdFromWan}9:0:6";  # ::/96
-      p6Size_ = 96;
-      ulaPrefix_ = "${ulaPrefix}:0100:0:6";  # ::/96
-      ulaSize_ = 96;
-    } // {
-      listenPort = 51944;
-    };
   };
 
   extra = {

hosts/router/wireguard.nix

@@ -1,72 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  vars = import ./vars.nix;
-  wg0 = vars.ifs.wg0;
-
-  peerIps = ifObj: token: [
-    "${ifObj.p4}.${toString token}/32"
-    "${ifObj.p6}:${toString token}:0/112"
-    "${ifObj.ulaPrefix}:${toString token}:0/112"
-  ];
-
-  mkWg0Peer = token: publicKey: {
-    allowedIPs = peerIps wg0 token;
-    inherit publicKey;
-    pskEnabled = true;
-  };
-
-  wg0Peers = {
-    "Yura-TPX13" = mkWg0Peer 100 "iFdsPYrpw7vsFYYJB4SOTa+wxxGVcmYp9CPxe0P9ewA=";
-    "Yura-Pixel7Pro" = mkWg0Peer 101 "GPdXxjvnhsyufd2QX/qsR02dinUtPnnxrE66oGt/KyA=";
-  };
-  peerSecretName = name: "wg0-peer-${name}-psk";
-  secrets = config.secrix.services.systemd-networkd.secrets;
-in
-{
-  secrix.services.systemd-networkd.secrets = let
-    pskPeers = lib.attrsets.filterAttrs (name: peer: peer.pskEnabled) wg0Peers;
-    mapPeer = name: peer: {
-      name = peerSecretName name;
-      value.encrypted.file = ./secrets/wireguard/${peerSecretName name}.age;
-    };
-    peerSecrets = lib.attrsets.mapAttrs' mapPeer pskPeers;
-
-    allSecrets = {
-      wg0-private-key.encrypted.file = ./secrets/wireguard/wg0-private-key.age;
-    } // peerSecrets;
-
-    setSecretOwnership = name: value: value // {
-      decrypted.user = "systemd-network";
-      decrypted.group = "systemd-network";
-    };
-  in lib.attrsets.mapAttrs setSecretOwnership allSecrets;
-
-  systemd.network.netdevs = {
-    "10-wg0" = {
-      netdevConfig = {
-        Kind = "wireguard";
-        Name = wg0.name;
-      };
-      wireguardConfig = {
-        PrivateKeyFile = secrets.wg0-private-key.decrypted.path;
-        ListenPort = wg0.listenPort;
-      };
-      wireguardPeers = map (peer: {
-        AllowedIPs = lib.strings.concatStringsSep "," peer.value.allowedIPs;
-        PublicKey = peer.value.publicKey;
-        PresharedKeyFile = if peer.value.pskEnabled then secrets."${peerSecretName peer.name}".decrypted.path else null;
-      }) (lib.attrsToList wg0Peers);
-    };
-  };
-
-  systemd.network.networks = {
-    "10-wg0" = {
-      matchConfig.Name = "wg0";
-      networkConfig = {
-        IPv4Forwarding = true;
-        IPv6SendRA = false;
-        Address = [ wg0.addr4Sized wg0.addr6Sized wg0.ulaAddrSized ];
-      };
-    };
-  };
-}