reo101/rix101
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(agenix-rekey)!: first try

Browse source 
Cannot `agenix rekey` / `deploy`
`agenix rekey` rekeys separate keys successfully but canot build the derivation that contains them
This commit is contained in:
reo101 2023-12-25 15:17:30 +02:00
parent 9eb47f44b9
commit 8feb5245ea
Signed by: reo101
GPG key ID: 675AA7EF13964ACB
16 changed files with 138 additions and 109 deletions
Download patch file Download diff file Expand all files Collapse all files

19
machines/nixos/x86_64-linux/jeeves/wireguard.nix
View file

@ -1,4 +1,4 @@
{ lib, pkgs, config, ... }:
{ inputs, outputs, lib, pkgs, config, ... }:
{
environment.systemPackages = with pkgs; [
wireguard-tools
@ -10,12 +10,17 @@
# wg pubkey < private > public
# Server
age.secrets."wireguard/server.private" = {
file = ../../../../secrets/home/wireguard/server.private.age;
age.secrets."wireguard.private" = {
# file = ../../../../secrets/home/jeeves/wireguard/private.age;
# file = "${inputs.self}/secrets/home/jeeves/wireguard/private.age";
mode = "077";
};
age.secrets."wireguard/server.public" = {
file = ../../../../secrets/home/wireguard/server.public.age;
# FIXME: agenix-rekey
rekeyFile = "${inputs.self}/secrets/home/jeeves/wireguard/private.age";
# generator = {lib, pkgs, file, ...}: ''
# priv=$(${pkgs.wireguard-tools}/bin/wg genkey)
# ${pkgs.wireguard-tools}/bin/wg pubkey <<< "$priv" > ${lib.escapeShellArg (lib.removeSuffix ".age" file + ".pub")}
# echo "$priv"
# '';
};
networking.firewall.allowedUDPPorts = [51820];
@ -28,7 +33,7 @@
MTUBytes = "1300";
};
wireguardConfig = {
PrivateKeyFile = config.age.secrets."wireguard/server.private".path;
PrivateKeyFile = config.age.secrets."wireguard.private".path;
ListenPort = 51820;
};
wireguardPeers = [