knot: fix preStart after hardening

[sourcephile-nix.git] / hosts / losurdo / networking / wireguard / intranet.nix

diff --git a/hosts/losurdo/networking/wireguard/intranet.nix b/hosts/losurdo/networking/wireguard/intranet.nix
index 423843c22fbf9d8ad3bee9451ce499e62a9ef5b9..217eca24af9ff9f93dfe5e1f477ed007461d65f0 100644 (file)
--- a/hosts/losurdo/networking/wireguard/intranet.nix
+++ b/hosts/losurdo/networking/wireguard/intranet.nix
@@ -4,13 +4,18 @@ let
   inherit (config.boot) initrd;
   iface = "wg-intra";
   wg = config.networking.wireguard.interfaces.${iface};
-  wg-intra-hosts = import (inputs.julm-nix + "/networking/wireguard/wg-intra/hosts.nix");
-  relay = wg-intra-hosts.mermet;
+  wg-intra-peers = import (inputs.julm-nix + "/nixos/profiles/wireguard/wg-intra/peers.nix");
+  relay = wg-intra-peers.mermet;
 in
 {
 imports = [
-  (inputs.julm-nix + "/networking/wireguard/wg-intra.nix")
+  (inputs.julm-nix + "/nixos/profiles/wireguard/wg-intra.nix")
 ];
+networking.wireguard.${iface}.peers = {
+  mermet.enable = true;
+  oignon.enable = true;
+  patate.enable = true;
+};
 networking.wireguard.interfaces.${iface} = {
   privateKeyFile = gnupg.secrets."wireguard/${iface}/privateKey".path;
 };
@@ -60,14 +65,6 @@ boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
 # This enables to send the disk password to the initrd, like that:
 # ssh -J mermet.sourcephile.fr root@losurdo.wg -p 2222
 boot.initrd.secrets."/root/initrd/${iface}.key" = "/root/initrd/${iface}.key";
-/*
-installer.ssh-nixos.script = ''
-  # Send the wireguard key of the initrd
-  gpg --decrypt '${gnupg.store}/wireguard/${iface}/privateKey.gpg' |
-  ssh '${config.installer.ssh-nixos.target}' \
-  install -D -m 400 -o root -g root /dev/stdin /root/initrd/${iface}.key
-'';
-*/
 boot.initrd.kernelModules = [ "wireguard" ];
 boot.initrd.extraUtilsCommands = ''
   #copy_bin_and_libs ${pkgs.wireguard-tools}/bin/wg