From f1c70dce99676455d8da957aebd8d6a460d75273 Mon Sep 17 00:00:00 2001 From: Simon Bruder Date: Mon, 18 Sep 2023 19:06:22 +0200 Subject: [PATCH] Revert "shinobu/router: Switch provider for wg-upstream" This reverts commit 0bcc5d61413d3b8cbcf8aafd3d813461c74dcd21. This leaves MSS clamping in place. --- machines/shinobu/secrets.yaml | 7 +++---- machines/shinobu/services/router.nix | 13 ++++--------- 2 files changed, 7 insertions(+), 13 deletions(-) diff --git a/machines/shinobu/secrets.yaml b/machines/shinobu/secrets.yaml index acdb8fd..54f3a7e 100644 --- a/machines/shinobu/secrets.yaml +++ b/machines/shinobu/secrets.yaml @@ -1,6 +1,5 @@ wg-home-private-key: ENC[AES256_GCM,data:gm4INfmp226u4wp+LuKgf5m2nTFFw4S24w4PRPcW/A7CU713c9NtQ+kPDKg=,iv:JAir9z5/Db6+Oroq+0vXPZLZLA2gjY2Be6hRAmgV5AE=,tag:fxL9nK3v5xERfcoBbCUsXg==,type:str] -wg-upstream-private-key: ENC[AES256_GCM,data:SjgY73YEI9t64KhhjtmBSqzbxp+Pz6twcei1/PgDyJEKHQ3zJTGutfM1oSQ=,iv:j6sUVzS6oAu9rUNtUwkit59vytJn1z9Ku8kGVFZOsbI=,tag:7iaeo5mvWqO7JraGMxLriQ==,type:str] -wg-upstream-psk: ENC[AES256_GCM,data:0XXEALKWvUQ7amx2hhia8a6Jd5WG1/+gEVI2edNukjM7BZj66FJ9YFMtSiU=,iv:C6w+P1RzJIggmzT5V5xu0IS/j5NLFiQOLoTNRILND1A=,tag:zZqmO4/GcYWmz2hUCP3W1Q==,type:str] +wg-upstream-private-key: ENC[AES256_GCM,data:CO50H7QsLQ2x0QQXnB7c0leG8NdV66gWrdWBWOR9z4ukSN7qj/qqe83t82k=,iv:2as2HfTfRje3TEap8QpPfzz4saNDgjo6Ty1DTF23JVE=,tag:ZYe+59wrpX7mV1HcDllMdg==,type:str] hostapd-config: ENC[AES256_GCM,data:a0ESrrsquLq6VRJM588C5A+FmVxJwJSzwRuv2o//LL5OybcDS8jkVUajosXEs0qmQ6Xfc1gFDcevCYUwJ24eZ+ynKLWwoNx8RXXwbpllO7FkI68vcauUij1CtUgVb8aHheKfrFuyW7WU1wE3NTtOt2gij1+nM3iKS3vFXtX2n9L2fuy2b3EhOUBiakxAeQmyVmclSVBDYt12i4h4tW7GpPr8AjoIiZgz0Hyx5zA5f/JTPzz/P200eM0tCttNPbMNPBGztJfw7raRIX+v6xw7QNPMgf03TOae17mt6uggTNKJfEPeanzcEMA3xR6xoFUqJL6Hvowyl4MrSFc+E5Rvft+qhp8m6tAqQln9Z3MzaDtxSBWnWdvWEcyeK1aDBQ57/aIwo8kVs47Iblqbi5+jM/n4DoeQtqTM1kS7sZ3XDQ26suW5KCw+VIeqEEqdu6g5ZXMO2SipSOzP5jPjX+5ubX3SXcyoAIo41Efa6YGdWtl3,iv:oLk5tatZEY5AI/PlTBJHShGCKiyvve9rPhGARAtMMj4=,tag:Bkan2Hff8L8ZcC67r+fWjg==,type:str] sops: kms: [] @@ -8,8 +7,8 @@ sops: azure_kv: [] hc_vault: [] age: [] - lastmodified: "2023-09-05T08:32:27Z" - mac: ENC[AES256_GCM,data:obOQ6xkGzmMnpEQGOk77onTNcvK+5aV0m2lGu+h+GLESKigls+vcBSqS/uuluPvzpWEVRMffnDzG9xuafU5r/GsOvzb7QzD7kGd+qe/U3XI2sI7fSQyMgRfcTV+YfgG2hrZ4inAufe1vprybVhl2Cx1pGxLuqHufc5KBZT6QRGU=,iv:3JYOkO8gtZLoMBtR9XWQ0OP/qr9JW23NJf6ACm/2aoU=,tag:Ocut0Q6RnVDl+/8CvJl9HA==,type:str] + lastmodified: "2023-08-08T09:43:37Z" + mac: ENC[AES256_GCM,data:lxoKzGyPwdfeI5Dlmgx9K9SBhfRIaokvum+dJWABUoGtIMtrhp4K4ZRF1Rjja8oTi4w3b+s9aUBpxt8TLu9vJZFsUkhY2gqW5bX3Ub/3xMAR9YSG3LtijRSMuKkdVlAkdjB6Guz9aHNVBG3fTZ+SfTlyOQdImW6bK4tydbGHKgY=,iv:6kVR4zZfHnqhcOT3N2tClGST8h7FLjIseXDu2xS2DEY=,tag:rd/f7cHSoxLT3O7HluVWLA==,type:str] pgp: - created_at: "2023-06-29T16:44:16Z" enc: |- diff --git a/machines/shinobu/services/router.nix b/machines/shinobu/services/router.nix index 8e41fec..d7a4d4c 100644 --- a/machines/shinobu/services/router.nix +++ b/machines/shinobu/services/router.nix @@ -36,10 +36,6 @@ in owner = config.users.users.systemd-network.name; sopsFile = ../secrets.yaml; }; - sops.secrets.wg-upstream-psk = { - owner = config.users.users.systemd-network.name; - sopsFile = ../secrets.yaml; - }; sops.secrets.hostapd-config = { sopsFile = ../secrets.yaml; }; @@ -167,9 +163,8 @@ in }; wireguardPeers = lib.singleton { wireguardPeerConfig = { - Endpoint = "185.189.112.26:1637"; - PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk="; - PresharedKeyFile = config.sops.secrets.wg-upstream-psk.path; + Endpoint = "193.32.248.71:51820"; + PublicKey = "eprzkkkSbXCANngQDo305DIAvkKAnZaN71IpTNaOoTk="; AllowedIPs = [ "0.0.0.0/0" "::0/0" ]; PersistentKeepalive = 25; }; @@ -211,8 +206,8 @@ in }; wg-upstream = { name = "wg-upstream"; - address = [ "10.128.218.130/32" "fd7d:76ee:e68f:a993:316e:a8d5:2b60:8e69/128" ]; - dns = [ "10.128.0.1" "fd7d:76ee:e68f:a993::1" ]; + address = [ "10.66.208.88/32" "fc00:bbbb:bbbb:bb01::3:d057/128" ]; + dns = [ "10.64.0.1" ]; routingPolicyRules = [ { routingPolicyRuleConfig = {