blake/nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

95 current 2025-10-08 14:44:19 25.05.20251006.20c4598 6.12.50 *

Browse Source
This commit is contained in:
blake
2025-10-08 15:52:49 -05:00
parent de2058eeaf
commit 1578a2a9f9
4 changed files with 24 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
flake.nix
View File

@@ -1,6 +1,6 @@
# flake for blakes nixos config
# define new devices in outputs
# generation: 94 current 2025-10-08 13:52:19 25.05.20251006.20c4598 6.12.50 *
# generation: 95 current 2025-10-08 14:44:19 25.05.20251006.20c4598 6.12.50 *
{
description = "blakes nix config";
inputs = {

3
hosts/snowbelle/configuration.nix
View File

@@ -19,8 +19,7 @@
syncthing.enable = true;
tailscale.enable = true;
vpns.enable = true;
vpns.openvpn_pia_mexico = false;
vpns.wg_pia_mexico = false;
vpns.wg_mex = true;
nvidia.enable = true;
};
homelab = {

32
modules/system/vpns.nix
View File

@@ -13,7 +13,7 @@ in
default = false;
description = "enable pia vpn to mexico using openvpn";
};
wg_pia_mexico = lib.mkOption {
wg_mex = lib.mkOption {
type = lib.types.bool;
default = false;
description = "enable pia vpn to mexico using wireguard";
@@ -33,27 +33,29 @@ in
};
};
# enable pia mexico w/ wireguard
# enable mullvad mexico w/ wireguard
networking.wireguard.interfaces = lib.mkIf cfg.wg_pia_mexico {
wg_piamex = {
privateKeyFile = config.sops.secrets."wg_pia_mexico_key".path;
listenPort = 51820;
ips = [ "10.4.244.34/32" ];
peers = [
{
publicKey = "avK/Bdg+hyLMqP2k/7eEBTkxwCSzyy8FymwO/vFjbQg=";
allowedIPs = [ "0.0.0.0/0" ];
endpoint = "77.81.142.245:1337";
wg_mex = {
# client settings
privateKeyFile = config.sops.secrets."wg_mex_key".path;
ips = [ "10.74.252.231/32" "fc00:bbbb:bbbb:bb01::b:fce6/128" ];
# remote settings
peers = [ {
publicKey = "yxyntWsANEwxeR0pOPNAcfWY7zEVICZe9G+GxortzEY=";
allowedIPs = [ "0.0.0.0/0" "::0/0" ];
endpoint = "149.88.22.129:51820";
persistentKeepalive = 25;
}
];
} ];
postSetup = ''
# Remove default route that wg might add
ip route del default dev wg-mullvad 2>/dev/null || true
'';
};
};
# secrets only if VPN is enabled
sops.secrets = lib.mkIf cfg.enable {
"wg_pia_mexico_key" = { owner = "root"; group = "root"; };
"wg_mex_key" = { owner = "root"; group = "root"; };
"pia_auth" = { owner = "root"; group = "root"; };
"openvpn_pia_mexico_config" = {owner = "root"; group = "root"; };

10
secrets/secrets.yaml
View File

@@ -11,9 +11,9 @@ ssl_blakedheld_key: ENC[AES256_GCM,data:Jhb2yiIYlfJ8mewzohseWQYZ2pEYy8x2c9B6OH/P
#ENC[AES256_GCM,data:A0ITyGOGMIoyVOcn5JOi1RAtqUM=,iv:+wWpmFbeLiX/Ae53pj0QmnYY3MEzOMib4cqbePUKtGI=,tag:JHXvrN4bOH+oD3Q70pUuew==,type:comment]
pia_auth: ENC[AES256_GCM,data:rwAu4f5XVS4v4FCLj2zXAegIZeRPLIzUVv6TCrdfg9RGSDJYHgVAX0aFXCBQsDQju9RDycXmc9Id8IuyYN8=,iv:kEA4ADQyUI+zlQoZOKi81dw5BLE1oesqhVf6bfiLgB4=,tag:VHT2uPNW27F3KRM7ZhWdCw==,type:str]
#ENC[AES256_GCM,data:7y1mtYNfbsagqtr66kOx2rinneEW3EZaCJIXzK0qjLX36g==,iv:8ozXuBYirLbKd8sCln2xv/WjhTojY85xU0cL5NVeMlQ=,tag:mclz0GfQ9j2EGWMiQ62QmA==,type:comment]
openvpn_pia_mexico_config: ENC[AES256_GCM,data:VsxrXpdrBpjP,iv:PIOTk/dADStM19EMwOsyoGBqy23eSoOCoiyUrd1obhQ=,tag:VP/gIg0by35glap3umK6uw==,type:str]
openvpn_pia_mexico_config: ENC[AES256_GCM,data:59HQ3OZ0QKq92jI=,iv:DZTNvfi6kLXG7dsNkPcXUmXhAG2UdPZBy/L9eWNmRdE=,tag:ndxDDQNL2z1fjxFfU2VRwQ==,type:str]
#ENC[AES256_GCM,data:mbIgMJBhL8nWJzl8q2dFL8XtO1Xa1Q==,iv:caYHYp1boK9wRgCcQe40HTWT/HxAIvYe+HyaruI53Vc=,tag:S6wowhAHObEcs7z8FimZ1g==,type:comment]
wg_pia_mexico_key: ENC[AES256_GCM,data:bT5Vi8ZGtSG48bZ6UHSH8+4y/KBrRhVFDmA+0A9b1G9zLcQ0VwRtSOZ8bWc=,iv:Lo/vScSGQ0VbdAq14dQ8hrWK+LgH4hiUTP4Ndx/FNLE=,tag:+pSbZuXNxRaV13V4Df+M2g==,type:str]
wg_mex_key: ENC[AES256_GCM,data:vxDXixo6X6D33+p21L4hB0/yCH+TvMHZl991BkRsE/jdz7rzZuJF+zI7h+Q=,iv:8WR+feHXNUcat8DB2wY7wpos+P7TzgRF7rFD0fYosjY=,tag:p9b9ck0/VZjyLxtHut3n5Q==,type:str]
#ENC[AES256_GCM,data:CO5nrcDbgymnEmCvuTexOBEMncuNM5lQ,iv:6HrxqSN6e7ODuz09MIFgPbIqDCKQySRDaKk5Wdu4HoQ=,tag:JBRjZeEdOg+trohfanO6Mg==,type:comment]
vaultwarden_admin_token: ENC[AES256_GCM,data:G1v3N064ci0Fw5EtTzaryailWpsv6f4w6eoHp2vjXIBtIlScdQk1Q0W+eDNRk8Wr2C3ysTXQNbyYismNsls+jeS3W+YqkKL4fnh3a5UTzQrMqvaH11n3ak0X9R9vmt+ZJXBrUrAOKJ6RPHJJSWenhjDB77kwEdQ=,iv:f8X+x/AdmZ3b3dtcSFrxGgA2tCgDRpgddjlVu3mdCmM=,tag:c0MXljVvhwOdvrb/8hWlsQ==,type:str]
#ENC[AES256_GCM,data:2ESzSsQZqKdjD7OXN8ZPThj6g9acJREe,iv:aDFPB0vs8NNo8ExLcJw7qtQvWbCb1XK6TJrHSK86qss=,tag:z+dypHAGUjEXP7Y9MHYWwg==,type:comment]
@@ -29,7 +29,7 @@ sops:
U0tmdFBuZnJES3piOTZNV0VKQmQ0eVUKCWRQ/flLzmpC64WyLoipklZBmrkpYiUg
PRu+itNolpPTHm96pe+P93g2iP0wgekG0cX21wkiU2xaLF3dY2FEIA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-10-08T17:55:56Z"
mac: ENC[AES256_GCM,data:Cut9mCck9q+9I4x1hI709TTVi2J/qJ2Lcs1C4/hya3JhsVAJQ7UR1NC19QbTsQzAmv5cpD6RzfGmATXo+9DUWkp/yiyQqfVIGw1UpiSzrQYMJPOb9uUWELgKvVTEf6xRjhIe1IgedcO1OefRhwMosk7q4DjLIIb6PsU2ibMjNts=,iv:wOS3aI2am+uKnRAorlSmDEjWu3YFB1SzbPae4jLAeyU=,tag:DHUxWQtp9EI34JykS+er2A==,type:str]
lastmodified: "2025-10-08T20:46:50Z"
mac: ENC[AES256_GCM,data:kSWpiorgrx4Ohv/ZpUCKuBy+g3VZ95UjaOeotUwXJzao3qbHHAKIRLCJnlJPjMDyT3aZc8AF3urQunl65LDHYAisTV1LxTAeFSsWm4xkJ5DcyhvTHh1yxa+G9lGZ6mBQK60Hg92+fqwS43ObYz8hwoVeeKXc0ZSwDqI5d8gSF9o=,iv:gVonEcRQTupdLEYgAfgI10L86h6q+PFdgpLHNsLHB/8=,tag:Rd2nlookzmUc0ZWnC/f1Dg==,type:str]
unencrypted_suffix: _unencrypted
version: 3.10.2
version: 3.11.0