move shiniji wireguard secretes to only shinji host (refactor hosts)

6 files changed, 117 insertions, 12 deletions

diff --git a/hosts/kaworu.nix b/hosts/kaworu/default.nix
index b481be0..cab2e3d 100644
--- a/hosts/kaworu.nix
+++ b/hosts/kaworu/default.nix
@@ -10,10 +10,10 @@ inputs.nixpkgs.lib.nixosSystem rec {
   specialArgs = {inherit inputs;};
   modules = [
     options
-    ../config
-    ../home
-    ../programs
-    ../system
+    ../../config
+    ../../home
+    ../../programs
+    ../../system
     {
       # options
       hostName = "kaworu";
diff --git a/hosts/shinji.nix b/hosts/shinji/default.nix
index 44116a7..df49157 100644
--- a/hosts/shinji.nix
+++ b/hosts/shinji/default.nix
@@ -10,11 +10,17 @@ inputs.nixpkgs.lib.nixosSystem rec {
   specialArgs = {inherit inputs;};
   modules = [
     options
-    ../config
-    ../home
-    ../programs
-    ../system
+    ../../config
+    ../../home
+    ../../programs
+    ../../system
     {
+      # imports
+      imports = [
+        ./sops.nix
+        ./wireguard.nix
+      ];
+
       # options
       hostName = "shinji";
       monitors = [
diff --git a/hosts/shinji/secrets.yaml b/hosts/shinji/secrets.yaml
new file mode 100644
index 0000000..44667df
--- /dev/null
+++ b/hosts/shinji/secrets.yaml
@@ -0,0 +1,30 @@
+freyanetWg: ENC[AES256_GCM,data:mUI3eIwFzanJz9iJCbIBDg3FMKdDMcOQ6u96mk5/zZd8MG5kuOG39wu8xZQ=,iv:Sd6EjuQiNhD0QupGpbRPJF7aIBCJJ3/LNNmUYlBMRNI=,tag:KFKoL0JbSfEQidaEzi049Q==,type:str]
+tinternetWg: ENC[AES256_GCM,data:5ajGIfQp06v4g3AbJFCzXrbxXw7cnoMWwwV8Ti03IDVUxSHlfDiGvB+F2XE=,iv:JOTd7Mc+gnckPAH9ev83y+ZGWwMsZJSQ34VHosNv0p4=,tag:5oAlaF7EgExiNPrZc+KMvw==,type:str]
+sops:
+    lastmodified: "2025-04-11T19:33:22Z"
+    mac: ENC[AES256_GCM,data:eD9BZlEgriyrmFqtb/EBmfQieI3/fh5vat1yPc3cQsBvs+lRlsYKBL367TiJ/giXso5KLqoIXAjeJwW/ogimMLACljgw9b3BbUcyhjvcUCXJS3BLe60oTDxLxY+PDyIM5BfrAVSK+1u8ruiOnIIaxfjc+cRsrQ8m5OZB+IoGAL8=,iv:k0tRFqW/syl+fcbzgaI7R6Pcen9+A2aWRCnAe9ydE+k=,tag:JpTyhYKMjP4a7BfdkGe1Hw==,type:str]
+    pgp:
+        - created_at: "2025-06-22T02:32:57Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4D0Q846mnV8HYSAQdAiydHrfiuvIlOIMBqpPWX/05MP5d5gIQjXIyc8tzdsycw
+            ZzzKJKsNh4XZd726Toks0CVF5NZLYLtMyAs8S2huf3gz6cgt3k8MI2qPmaEJMDBQ
+            0lwBjTp5//gCK0YbO76IxvteL+TgiklwJN03ryMl9Mj8JVVMmiBh25PGuxblbi52
+            pEJMVlxJVUxrHQY+XREZKhNp73JLRovZHFDMpSR5TAZxD6ZmtChElk5ofKVFiw==
+            =suGj
+            -----END PGP MESSAGE-----
+          fp: D9AF0A4209B7C2DE11A884BFACBC553660D9993D
+        - created_at: "2025-06-22T02:32:57Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4D/YCJcy0T0DkSAQdA3Vc35wBJSjwWaNbYa2s4wKGsXOnz6ucSk62vnXGxYTUw
+            Y8uSyG6Jf040oEgAixd46s1H30CmT0+Hi6zF7jGweo1yGzEFZ53v+VVusCv2JbI7
+            0lwB7LnU2M6SAkvhr/SJTEVz9Uu/cx6xJnFeGXWXwY6mPN+InOee7UJW3Ffv2n/t
+            7PoojznXONSma2Xc8u3Ywk83jMrKqnNLMEATqnCg/1FZHe8Asr6Lan6KD0U81g==
+            =azav
+            -----END PGP MESSAGE-----
+          fp: 2A8A27879715447AEEC59D0C18DCCBE353963394
+    unencrypted_suffix: _unencrypted
+    version: 3.10.1
diff --git a/hosts/shinji/sops.nix b/hosts/shinji/sops.nix
new file mode 100644
index 0000000..fa3272c
--- /dev/null
+++ b/hosts/shinji/sops.nix
@@ -0,0 +1,30 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}: let
+  isEd25519 = k: k.type == "ed25519";
+  getKeyPath = k: k.path;
+  keys = builtins.filter isEd25519 config.services.openssh.hostKeys;
+in {
+  imports = [
+    inputs.sops-nix.nixosModules.sops
+  ];
+
+  environment.systemPackages = with pkgs; [
+    sops
+  ];
+
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+
+    gnupg.home = config.homePath + "/.gnupg";
+    gnupg.sshKeyPaths = [];
+
+    secrets = {
+      freyanetWg = {};
+      tinternetWg = {};
+    };
+  };
+}
diff --git a/hosts/shinji/wireguard.nix b/hosts/shinji/wireguard.nix
new file mode 100644
index 0000000..13669b3
--- /dev/null
+++ b/hosts/shinji/wireguard.nix
@@ -0,0 +1,39 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = with pkgs; [
+    wireguard-tools
+  ];
+
+  networking.wg-quick.interfaces = {
+    freyanet = {
+      address = ["10.2.0.2/32" "fd:cafe:dead:bee::2/128" "fe80::2/128"];
+      dns = ["10.3.0.138"];
+      privateKeyFile = config.sops.secrets.freyanetWg.path;
+
+      peers = [
+        {
+          publicKey = "x0ykwakpYCvI/pG+nR83lNUyeOE9m54thnX3bvZ+FUk=";
+          allowedIPs = ["10.0.0.0/14" "fd:cafe::/32"];
+          endpoint = "cid.freya.cat:3000";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+
+    #tinternet = {
+    #  address = [ "69.0.0.2/32" "cafe::2/128" "fe80::2/128" ];
+    #  dns = [ "1.1.1.1" ];
+    #  privateKeyFile = config.sops.secrets.tinternetWg.path;
+
+    #  peers = [{
+    #    publicKey = "8Ice49Yc7N75OYJW59ohDbfUjgrkwIuGWKWocJQGgzI=";
+    #    allowedIPs = [ "0.0.0.0/0" "::/0" ];
+    #    endpoint = "freya.cat:51282";
+    #    persistentKeepalive = 25;
+    #  }];
+    #};
+  };
+}
diff --git a/hosts/thinkpad.nix b/hosts/thinkpad/default.nix
index bb7a75a..082e13f 100644
--- a/hosts/thinkpad.nix
+++ b/hosts/thinkpad/default.nix
@@ -10,10 +10,10 @@ inputs.nixpkgs.lib.nixosSystem rec {
   specialArgs = {inherit inputs;};
   modules = [
     options
-    ../config
-    ../home
-    ../programs
-    ../system
+    ../../config
+    ../../home
+    ../../programs
+    ../../system
     {
       # options
       hostName = "thinkpad";