From 680ab0222de3976eaea3ba0bf91880c8757e5d30 Mon Sep 17 00:00:00 2001 From: Saku Laesvuori Date: Fri, 14 Aug 2026 13:28:49 +0300 Subject: [PATCH] =?UTF-8?q?Lis=C3=A4=C3=A4=20kolon=20p=C3=B6yt=C3=A4koneen?= =?UTF-8?q?=20(ja=20reitittimen)=20k=C3=A4ytt=C3=B6j=C3=A4rjestelm=C3=A4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .guix-channel | 9 +++ channels.lock.scm | 10 +++ channels.scm | 9 +++ files/OMS-kone/dhcpd.conf | 6 ++ files/OMS-kone/nftables.rules | 32 ++++++++ files/sops/.sops.yaml | 10 +++ files/sops/OMS-kone.yaml | 42 ++++++++++ files/sops/README.md | 48 ++++++++++++ .../admin-encryption-keys/saku-laesvuori.pub | 52 +++++++++++++ files/sops/encrypt-private-key.sh | 9 +++ .../host-decryption-keys/OMS-kone.key.gpg | 40 ++++++++++ manifest.scm | 1 + modules/oms/systems.scm | 78 +++++++++++++++++++ 13 files changed, 346 insertions(+) create mode 100644 files/OMS-kone/dhcpd.conf create mode 100644 files/OMS-kone/nftables.rules create mode 100644 files/sops/.sops.yaml create mode 100644 files/sops/OMS-kone.yaml create mode 100644 files/sops/README.md create mode 100644 files/sops/admin-encryption-keys/saku-laesvuori.pub create mode 100755 files/sops/encrypt-private-key.sh create mode 100644 files/sops/host-decryption-keys/OMS-kone.key.gpg create mode 100644 manifest.scm diff --git a/.guix-channel b/.guix-channel index 200d894..f7458b0 100644 --- a/.guix-channel +++ b/.guix-channel @@ -4,6 +4,15 @@ (keyring-reference "keyring") (url "https://git.olarinmaensamoojat.fi/OMS/tietokoneet.git") (dependencies + (channel + (name sops-guix) + (url "https://github.com/fishinthecalculator/sops-guix.git") + (branch "main") + (introduction + (channel-introduction + (version 0) + (commit "0bbaf1fdd25266c7df790f65640aaa01e6d2dbc9") + (signer "8D10 60B9 6BB8 292E 829B 7249 AED4 1CC1 93B7 01E2")))) ;; Ikävä kyllä OMSin tietokoneet tarvitsevat ei-vapaita laiteohjelmia (channel (name nonguix) diff --git a/channels.lock.scm b/channels.lock.scm index 286461e..73af28d 100644 --- a/channels.lock.scm +++ b/channels.lock.scm @@ -8,6 +8,16 @@ "9edb3f66fd807b096b48283debdcddccfea34bad" (openpgp-fingerprint "BBB0 2DDF 2CEA F6A8 0D1D E643 A2A0 6DF2 A33A 54FA")))) + (channel + (name 'sops-guix) + (url "https://github.com/fishinthecalculator/sops-guix.git") + (branch "main") + (commit "c53e27e533836ea8595626ba6796dee5362f8c4a") + (introduction + (make-channel-introduction + "0bbaf1fdd25266c7df790f65640aaa01e6d2dbc9" + (openpgp-fingerprint + "8D10 60B9 6BB8 292E 829B 7249 AED4 1CC1 93B7 01E2")))) (channel (name 'nonguix) (url "https://gitlab.com/nonguix/nonguix") diff --git a/channels.scm b/channels.scm index 81b8dc5..e549eed 100644 --- a/channels.scm +++ b/channels.scm @@ -7,6 +7,15 @@ "9edb3f66fd807b096b48283debdcddccfea34bad" (openpgp-fingerprint "BBB0 2DDF 2CEA F6A8 0D1D E643 A2A0 6DF2 A33A 54FA")))) + (channel + (name 'sops-guix) + (url "https://github.com/fishinthecalculator/sops-guix.git") + (branch "main") + (introduction + (make-channel-introduction + "0bbaf1fdd25266c7df790f65640aaa01e6d2dbc9" + (openpgp-fingerprint + "8D10 60B9 6BB8 292E 829B 7249 AED4 1CC1 93B7 01E2")))) (channel (name 'nonguix) (url "https://gitlab.com/nonguix/nonguix") diff --git a/files/OMS-kone/dhcpd.conf b/files/OMS-kone/dhcpd.conf new file mode 100644 index 0000000..d1da6bb --- /dev/null +++ b/files/OMS-kone/dhcpd.conf @@ -0,0 +1,6 @@ +option domain-name \"kolo.olarinmaensamoojat.fi\"; +option domain-name-servers 192.168.1.1; +subnet 192.168.1.0 netmask 255.255.255.0 { +option routers 192.168.1.1; +range 192.168.1.100 192.168.1.240; +} diff --git a/files/OMS-kone/nftables.rules b/files/OMS-kone/nftables.rules new file mode 100644 index 0000000..9b74c7a --- /dev/null +++ b/files/OMS-kone/nftables.rules @@ -0,0 +1,32 @@ +flush ruleset + +table inet firewall_and_nat { +chain samoojaverkko_input { +accept +} +chain wireguard_input { +accept +} +chain input { +type filter hook input priority filter; policy drop; +iifname lo accept +ct state invalid drop +ct state { established, related } accept +iifname wlp2s0 jump samoojaverkko_input +iifname wg0 jump wireguard_input +} +chain forward { +type filter hook forward priority filter; policy drop; +ct state invalid drop +ct state { established, related } accept +iifname wlp2s0 accept +iifname wg0 accept +} +chain output { +type filter hook output priority filter; policy accept; +} +chain nat_masquerade { +type nat hook postrouting priority srcnat; +oifname enp1s0 ip saddr 192.168.0.0/16 masquerade +} +} diff --git a/files/sops/.sops.yaml b/files/sops/.sops.yaml new file mode 100644 index 0000000..067d528 --- /dev/null +++ b/files/sops/.sops.yaml @@ -0,0 +1,10 @@ +keys: + - &saku-laesvuori A0C91947734F076F5F08E9FF257D284A2A1D3A32 + - &OMS-kone D70ADEB8DFCC7DDB13B83E9B60E9442BA424EBD3 + +creation_rules: + - path_regex: ^OMS-kone.yaml$ + key_groups: + - pgp: + - *saku-laesvuori + - *OMS-kone diff --git a/files/sops/OMS-kone.yaml b/files/sops/OMS-kone.yaml new file mode 100644 index 0000000..d8fd163 --- /dev/null +++ b/files/sops/OMS-kone.yaml @@ -0,0 +1,42 @@ +#ENC[AES256_GCM,data:GCmBPDuXu5IFMFaajxDqJYs2yTs=,iv:kPnHq9jv1E8gr48sv5QiDGPq+QZVxlcG0cITwC7FXFM=,tag:ED+rzah7ELjTouJAEErRag==,type:comment] +#ENC[AES256_GCM,data:ITRmubrQRL6H5LBQttJmsOGnEA==,iv:Qb8ChChkrgew79iOQGFYdz42Z1pM6BLVME01OwlLfuw=,tag:F7xoOJ+xtWxmVY19Z8mefw==,type:comment] +#ENC[AES256_GCM,data:hFjd28QRs4n5yulbo26Ohd0GHX/Dzpw7Sh/Ts4eZfGsr7RPFAot0OmamHt4Qpdz2kpivHdqO/0a7,iv:wBCY9TDW6VsCyJ7h8G/1NdCAYSnKRJhjOJFryZwhEL0=,tag:PcYkwsv4MJd9E8kwX2xNJw==,type:comment] +wpa-psk: ENC[AES256_GCM,data:kn/SkxD2YSHXS8VrskE8GdW5GmCGIxkczoXiInJagcRWuq/xE7JDFRdaT9p/SBRbRESOzCvP7dzbCeoQ7h6Hpg==,iv:qZtAPVzjDCJ8En33c7n3dG0UiQK1VkNHMRtw6VBvtQ0=,tag:B88Vg5oFn8XjhAwUiClaSA==,type:str] +sops: + lastmodified: "2026-08-12T13:56:49Z" + mac: ENC[AES256_GCM,data:MY/ZEi/MzwHPSwTeXsnufRjf3hOs+zDtD8nPTTBbFOh+Xaes64wDI0hgIFn/RwKyMvwI0XIeA4dZ/UWsvZe5CId64JtJ5dxcmB9hUozIdtIT+20bmfhOFG7ww5X/5wimw9BjMjfP/hX+owB5G78LCa8dmNMkHEmybfK4WfwmC8c=,iv:lHO1bn+7mXtbRacj7qoVPIZyOe1BmShXIRFvUWf0MB0=,tag:MyC7ilGZwASppPhQZ2Fl3Q==,type:str] + pgp: + - created_at: "2026-08-12T13:05:39Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA/QlAv6mQqxoARAAm/Q4hyhJ797BpoydN6HcI8olVVXZvp3oQ0WxILt1wH5N + 7E6JfAEzxzdpEC/2lyS+IORMnLgkhJzlBTv2Wd34mlWeZ08EnhmMpMBHBeUWj6Ah + bKJFxfPb2MqcHBm1CLft/ei7mOVnnEb6qzzkXhWFFhxb34e8HCn0oIgREGqpBv6q + BQNFYmt9IOQOFvmfnYhppBRL/UyaWENs0veINncmY36ElsFAfb2dpPqJbeEXKnJG + +78nUOpctKfKDe16RPHLuiFWKMfzamciPBO0j1YoJo4wh8zoe1l6A0Ar4yFpgpL3 + 4KpNdwZrNjzBH2GTMQ8LdZjnWVcX2V5ZQ3I/srWHSKqFl/Q/pXclSCecV9afZzV1 + sAvwg1T/WCpJ82LGfJBnYMB2EGhmIAkMCV1tpAacK1MN5rHcuJak3wvRVm7RfEP7 + n6YoQU7XUkXgsw9rg9tuWt90T3O6Z5PC6f3YtZ4K+yVrA90OKxLhmLxjCnPINikT + 2rP3biMge5eUplReUtObuxuNr+qVyaKPLPxaW2gBzQ+wjE2O2X2p5McQTGRzh+hi + N7foCjniEzQapjV6cjjKwBJS8l+tYxYfuA4yGSJN5O4zc5KgQwP8Lq1ExvYu1hol + 1XUDjjn46zUzLDvGP7bu/21NOY8e1lKd04fYFUn5czx1MlyrDpmp54zxvKgr+urS + XAHQSDnaDhh+2s203YL/j2CSs1oNEbN7ctEaqlvoXhAeGmMAAowFDW9eR3HPtnus + 65nH3OaXgUIFlARaLYpJl8/pbB06C24qRLah3jaX3dTSFigTv77DyE3ZeUZe + =ttg1 + -----END PGP MESSAGE----- + fp: A0C91947734F076F5F08E9FF257D284A2A1D3A32 + - created_at: "2026-08-12T13:05:39Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hF4Du53yw99JEwQSAQdApGSh5Fbt0y9PGIF6MLk1JkaF4anF9r434ezd9Dj+Gkcw + QjMFXhGR/l/QVw1q5Rkwac1FgNpevuWwlupAzmXsD3/yViM+8OwV/+RBCDSSzyUE + 1GYBCQIQ6gI3gx5E3G1mjLwiSzh6zCxfgpYXeX+desnsgsldj/zkYLnMteTHy7/x + /BsURV7CyK6sT/B6okxq1H/lZV3Xr15kvMIc8t44XYkFq+2eyIn5BAOZDLqTZ8Tx + EZEc6BiaE7U= + =5mFp + -----END PGP MESSAGE----- + fp: D70ADEB8DFCC7DDB13B83E9B60E9442BA424EBD3 + unencrypted_suffix: _unencrypted + version: 3.12.2 diff --git a/files/sops/README.md b/files/sops/README.md new file mode 100644 index 0000000..a941212 --- /dev/null +++ b/files/sops/README.md @@ -0,0 +1,48 @@ +# Guix SOPS -salaisuuksienhallinta + + + +## Uuden laitteen lisääminen + +Jokaiselle salaisuuksia tarvitsevalle laitteelle luodaan oma PGP-salausavain +seuraavan kaltaisella komennolla. Olennaista on, että avaimella ei ole +salasanaa eikä se vanhene. + +``` +gpg --batch --passphrase '' --quick-generate-key \ + '(SOPS Guix -salauksen purkamiseen) ' default default never +``` + +Tämän avaimen yksityinen osa tallennetaan salattuna kaikille ylläpitäjille +hakemistoon `host-decryption-keys` käyttämällä apuna `./encrypt-private-key.sh` +komentokyhäelmää. Kyhäelmä hakee ylläpitäjien julkiset salausavaimet +hakemistosta `./admin-encryption-keys`. + +``` +gpg --export-secret-keys root@LAITE | ./encrypt-private-key.sh > host-decryption-keys/LAITE.key.gpg +``` + +Lisäksi yksityinen avain viedään laitteen `root`-käyttäjän avainrenkaaseen. + +``` +gpg --decrypt < host-decryption-keys/LAITE.key.gpg | ssh root@LAITE 'gpg --import' +``` + +Avaimen tunniste lisätään salaisuuksienhallinan ohjaustiedostoon `sops.yaml` +omalle rivilleen kohtaan `keys`. Tunnisteen saa näkyviin ajamalla komennon +`gpg --list-keys root@LAITE`. Kun kaikki ylläolevista on tehty, laitteelle voi +asentaa salaisuuksia. + +## Uuden ylläpitäjän lisääminen + +Ylläpitäjä tarvitsee oman PGP-salausavaimensa, jonka voi luoda esimerkiksi +GnuPG:llä komennolla `gpg --generate-key`. Avaimen julkinen eli salauspuoli +tallennetaan hakemistoon `./admin-encryption-keys` muita ylläpitäjiä varten. + +``` +gpg --armor --export AVAIN > admin-encryption-keys/YLLÄPITÄJÄ.pub +``` + +Lisäksi avaimen tunniste pitää lisätä `sops.yaml`-tiedostoon. Jonkun aiemman +ylläpitäjän pitää lisätä uusi tiedostojen salausryhmiin ja salata tiedostot +uudelleen ennen kuin ne ovat hänen luettavissaan. diff --git a/files/sops/admin-encryption-keys/saku-laesvuori.pub b/files/sops/admin-encryption-keys/saku-laesvuori.pub new file mode 100644 index 0000000..a44b8ba --- /dev/null +++ b/files/sops/admin-encryption-keys/saku-laesvuori.pub @@ -0,0 +1,52 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +mQINBGCJJvcBEADEsx42OdBcdslRop/VYmEe/KMAEo5zN7mKapZeS8ZeR3dvgxUh +3c4uIv8LoWHPbBdnslL8FhSzjxn7L11QOfLwzgdzoMqjVUJJaggvukhkjJXl5mja +Yzta5/zmUGVgruHlsqFcJcnICnOgCCZDAVjSw/rTbkd2RN1oVte0b3MCZUv7A3Xi +Z6yCrWL0yQikGIQi1CBvdTbca1aUMuhgpyaq1SCUfbe+oq4jc2mvnVsIZucDs48U +ofayLDye0GsjOo2vyPRalBq1XhA1hoQYtfdqcENyiMAumfnzJ24ou+YRd2RXPKcc +dy9FQrhL7hLwp+bewPXbrObgCiV2NyussShFe/m6C0A6RFBLSfG+dTFt4F/joWei +yJmjt6FIRpHvTEjluvpn3ApO4JmlxBlTIUBcgJJp/UQ+IUSYEOAdoOw9RGn1sNG8 +uN++AvQXZZyFCMFrd1amJd6rjqVvIyc7DGyilmBF7os2p/iss+sQWdlAKuZQU6Zv +xFR3Ltl+qhYNATSuKh9z7VdSiBLCJEHam4htdduwRroh5gXjQjAaLNPDihBLV46Q +Oz3iI6gZbF3+QQy03hqXXc9W98tfd/nXgepD2S8SZPCmY3SY7JI9E98HGH7JiHeg +cpOfK9Knn5NGfH92PyOjRnowvsNHLsR1VsmlNovk5wkNfRRPg5TBRDXcMQARAQAB +tCJTYWt1IExhZXN2dW9yaSA8c2FrdUBsYWVzdnVvcmkuZmk+iQJXBBMBCgBBAhsD +BQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAhkBFiEEoMkZR3NPB29fCOn/JX0oSiod +OjIFAmlX1uAFCQqv42kACgkQJX0oSiodOjK0Gw/9EktRq8Uip53fzMr8MeTm/qcm +aO8/dlYIAF4i+QjGWrHTv6PfP8lFLEm/Q+AktvjKhvOzIJA1tGKHGZWnQMLwDNx2 +uEBaStoHI9sXFH73Sqb/sopcbY9z7tV6fRHxMYwAnCgwjgxT4C6Q/gs9EG2z7Jjg +TXUklHXjKavnviLDP+G4M4ce3JlHR/RhAtX6M23mmvRSGBdDBsJ1kC8ot1xSnJNo +Xo6LSpA994OJyQ5c7EFqSsBU0E2Vp/7hgT2vBufZg9oVsEjmPBrLHPcEPt6qu3lr +mNjDgDWM6poopelqnn3+GTNaLGi20JDz/8S+X+X0v4YLevSFgBseATtB0nFngQ4X +nnkRvfVZWMQUUF7K8RCbtfLREy84WfEhPy7hVzbyuYhynTpvD3chCLoyWjXPV70X +BggdKDJLeVUBFXk2kZ+qQiwFeSv++/FSgIQgwRJiVB0eVNLPCdcWXr5kcel2gbEe +C17T/z6DJiXMjrrht3vdm+g7K0jAk7UaIr/oBxEYPkJoru1N811YAk0Rys1+cHqe +6swARZrdpYaBY831XJ77nuVjAqBR0JGKaW1UaPsK0ykzbIa30SNaIqt0cFBDjqbG +ia3LQ/is1UqRyiJXdS47/WBGKt6mAj+OhW7fnl1Ps2YglGh+4ZehvpRdEVBG6pM/ +ciOkn08eT+cOey8KpxS5Ag0EYIkm9wEQAL3qGd774FTzLFqjJICQWYisCBst07Tf +4aVKRJEQZkKnWNOQzQltSa5nHRLVtdEvvbejK+Ci8/l2yI58PkqkbKlL9K/IRgHn +8xqxWVcirbDZq32g5SI0zSa1B296o12TJrKGBSGBcAI0NRUaSUJmGy4HvIGdf8oV +xqvNDKL4I2igf5Kj3mMOZzFjbOr17SUetF72W1w5BAqLWX32YVXnC/RHP7WRuFv7 +LLpsAHOgnInQ44BF8WQdxnliJr18Pz/kyW/otMsVq4OxNMwYTiRDqBmDNPZmLHTd +thXvb41pI95Opk/th/8xc3+w1wAfcrx/vRccvfgr0nN4q4mqKAZSp4qJQocGF8xf +JGc0CurTdQwQT2yWEmoVIqoQLTJOhX8NuC9JI/U8b2riRMcAVU37pzHWxUepsbH/ +rEVYbVSaSRLVKTNCOmDSvOtQ7LZBHvAoVGG7Zzoluqg0X2GqrdCyCaBdFBgWOlw8 +/2q+dR6JxMXcmSDxAJuZgI2oR4bTSXPbQT5ezqSq/71g2+CKw5me4KEOoZiuAVOS +vMv05wU3/s3yJpCYK5OMsBgRaSWE7+QIQjr4+467/Bxo3mP5eIgKA6M67qT89TIK +VSALA14mCnc991fW67ib9Y4Sx9ZtHvaYL5i6tZ143ShTfsfifpyoZt0LhA8CL3Ac +W6wpqdgcIoWPABEBAAGJAjwEGAEKACYCGwwWIQSgyRlHc08Hb18I6f8lfShKKh06 +MgUCaVfbzwUJCq/oWAAKCRAlfShKKh06MjjPEACjw1+ZuXLpQYj4ZSkpq6iL2LoJ +AyxmxHUKeZDGMhyyf+Tt06l+cY2Gj2fGfSlRawDbfaoVoVV3crH0dzwUh3FeIfMM +6Xj1h1hsUJhFxKkaLSd1jfyf3ycuJ/XoxACt+gVEW6/EkOQMRI6gAjPJDYmh2a5K +WmArWJXzUk0RIQ147qbi0EdcI5FUIUj1hGvrwjXhfsbdbwH8gm1fQ/6iKr9EilLS +pmmAmaTMtmz0GfUi95ksV1tQF8wTogDcUE2LHCfZLz9fXqh3JKkdl5uXcrJYjFRk +A16/1aiL5RhEaNcIj6luiuhRZ1wLGdW2eSw0yeCIkxgwY1/C8oJze2V4Gybywcof +cZNs4gDFxqCM65H+17f8oTIeuQ0Wuphxde2F7Gy8M2/RBSm9750Mx8sx4qyjUqXb +OIMM1NeuRlY2pehHbhgPTiVFfDkFrY8mYLAMeW5txUrfs/m+ocu0sDau/rInX6uP +mezxbJ5z182OLIkDLB1XaN/ThZbJbsB4TjXNrXjk40UgwLEwJ07jA2uZcgRCpwzJ +OEvEr9u56z0fQCAlQTfTNCbndzZXBygtayg2CfhDg7gI/d/nLm2xqx6ZaFVGQEz1 +kiuzcsLPmeu7zI9ehSui6o7g77q2e2sq96OVvTzX3m0Iyqip+Y3If7pT3CZBvsXe +8WXUYb+YeXxijAcFcQ== +=AmUD +-----END PGP PUBLIC KEY BLOCK----- diff --git a/files/sops/encrypt-private-key.sh b/files/sops/encrypt-private-key.sh new file mode 100755 index 0000000..c9726f9 --- /dev/null +++ b/files/sops/encrypt-private-key.sh @@ -0,0 +1,9 @@ +#!/usr/bin/env sh + +recipients="" + +for key in admin-encryption-keys/*; do + recipients="--recipient-file $key $recipients"; +done + +gpg --encrypt --armor $recipients "$@" diff --git a/files/sops/host-decryption-keys/OMS-kone.key.gpg b/files/sops/host-decryption-keys/OMS-kone.key.gpg new file mode 100644 index 0000000..0aed28a --- /dev/null +++ b/files/sops/host-decryption-keys/OMS-kone.key.gpg @@ -0,0 +1,40 @@ +-----BEGIN PGP MESSAGE----- + +hQIMA/QlAv6mQqxoAQ/+IxiRZ13lM9CT7lwB9Ewpge+C1BPls9oKbsP0SGljHioQ +zDV87YewbECrDuw6MzYxBtig5vbNMfpy9y78f34U4R7ICQ450SpqpCzz6V1C6mVb +aZxz16IvS1cniQkqY0NFXczuiLteGCFn6Q3S9s35OWWk/PCVibs4npTI+zKGOvw9 +BoQbn8eo5y4zdcxhFvYZzzkypNjxHY+++HcyXesNvMgTzcNDnwjkzyFGxcsN9CtC +0HIy7sfxXy9hIWj9KHf9gIdZKRaH+1/7W90h+UimJcvDuyEe9+t7VkQHY8l5aihf +5TOgeE+Lr3WgaiZnYUPbyUn66bzgSk9gpr04TpnTTj2txo1Unvb8TbKmqjT5xHP2 +ds/tVw3sBdRjMHS0LSpD+gJmn97ZIKfSmSPGfXnvKU/frLF/oIm9tUnU1W1fDNX4 +eBNZUwicXL8JSrjjKEYlUwUjqpnezUuns2WH6Tm3npa+rGS9gVcf1fYq8YCgcBvB +i4LEMFFCTrHrMI/VkG8H7nLG69olf9gjglrKjC+ddpzDarC1iZVX0g/hJRGaoql6 +iIqtNRPAYv4iV484t4xyzMVGra5RIFhYS9wknbgVyPkB9AuDBfttuV/8hSv08m5s +5WjTY4zULV2KPPL3mLVBat5B/MPkOwkifMlYqgULx7nWe/6c+7NGRb6V/fsQB6nS +6gH4DduuI5fX7LIcx8sLjEB3nQju5BquYehjf9WGUOD2WuvdPJxyfmsZ5Rd9ky7H +fjhvHuoDybqMyjb/e8DAyhVWmVQpJfWQnZIXua5I55sr1cq2KhQzG/1SgKiGGam+ +yHXksNNyy/koUOmUhByKu9eozUj8+TJfJzi0hHN7kTARntiLaBeAeilqQpCocdCR +/VQFKfHEKSGaYt28SsAXCri59zzS4deq5Yp/NuNEFCDyr2oYiX4gjcHUH2dqU9py +msFBSj3eaXMB3rFTOwDpW9Umo/3+ji3D4zMFmBDOV4G0qEDCKO9rHVGwgevojrO6 +DNU5hVj/xh6DNCewQ/fbQKAcbGdvJCN7eZIlEs0Kq9JJQL/R8Qa6C2PD9VrQ/Ezn +K+8umVe/+DSDDMvdv3KmVd2y/u8yRLc6Jcx1AyAMQg59PeBkYC5qWl+/mzTPediy +Eq1CaM/ojcqYR0RS+kANJMxXSWaxecPt0hVGFtHa4Ra2464fcolZX2STr04ZYV17 +G3O7vuDEVWFZ35cjH7i+vtqK4XxdDkqq8CuXhbBjov3i1IDcUu9j8UJMRhzvqS7N +OQWqK7rejLy7Yg5dQBDUokOHWWTXsO3WjwNHN4FQZ1BY8Uy3UDXoJX+69N00XAIp +gplViNc5qDT2UCgCUGDN3viCtF/u3oSz87HgD+TgGEAWtabjxoHxhmzDea6HyzB+ +QGJuGVR1Jbbl+CAHBIa897ej3dRz25NBNFlYPwbHf6BNQq9gZZ35Vw+3LMMgS1a0 +tEaWKRzlkdFo2kH1Im+8s4l6Wj9KDOqSu+djpzwtayorI9Bi3tlfe5K8uGWFCH7C +HjHXApdFG4Y/faJEYPl866396K32XqbGBWG/43VO+XZLYrQvp4fKuuruGlpqDZHc +pW1eSkBiBYiu2apn+GeJwnczH7ZNZKdU3XiS2niAH2onXgjHxSbfknSm7HqqkHdh +yph03teQn+hJSF96hXwgcJoBTQ6OZiqzliXEj1pDlcHJAQa11K8Vd1iBzgJwD/n0 +eQDtz0AQTobmBLs84DZgT/+q8GOFhNjwwuaY1iOP7fyJ6fgthxDVUv5p2ea/UTnb +8e00d1oh8DAbJgJOVEOkqabdZH9l0m+Mh8As3Z7ISVJ/FXInGTM5nR7VRwq3tRUd +9lT5ECD73ojmYEr8TLkvsmtCknLMn+H1B09kI2wrgBIgTojOt5A2a4XAO3OGhQ3O +75FbzelKvRzLwf5wULkoMXZEKJ8NLiEG9WJKrcetY4s9NTgJl81GOBpo9NrRXtxZ +H9xBKXngaMQEWKQXcuoIKzOQCQcLPE9fitMWHSVGe9DcJK4H6nJKZtotNh1B1CtE +czmmlbyiMenZp65kQ1Bo3OWTXUBLcKAP7fEkuNfgOFOTC/cbRgT/KMyCk2QZpeO3 +TvF8Va3DwIfAda1JNvBqimJLZxOvH2SP2sHBer2N5M50xb8filhy3GflbNFaCBmv +FUH6OLFWpWbanoEDx57vWkTZlTN2IvtV3WlOEAweFbmaO4LzOWH3zFJ8zOkzenr/ +PMDALdN2jfmnxE/zJvYD82TbanNy +=PuIl +-----END PGP MESSAGE----- diff --git a/manifest.scm b/manifest.scm new file mode 100644 index 0000000..fcfd0b3 --- /dev/null +++ b/manifest.scm @@ -0,0 +1 @@ +(specifications->manifest (list "sops" "wpa-supplicant")) diff --git a/modules/oms/systems.scm b/modules/oms/systems.scm index 65f6554..be1c724 100644 --- a/modules/oms/systems.scm +++ b/modules/oms/systems.scm @@ -5,13 +5,19 @@ #:use-module (gnu services base) #:use-module (gnu services cups) #:use-module (gnu services desktop) + #:use-module (gnu services dns) #:use-module (gnu services guix) + #:use-module (gnu services networking) #:use-module (gnu services ssh) + #:use-module (gnu services sysctl) + #:use-module (gnu services vpn) #:use-module (gnu services xorg) #:use-module (guix gexp) #:use-module (nongnu packages linux) #:use-module (nongnu system linux-initrd) #:use-module (oms channel-file) + #:use-module (sops secrets) + #:use-module (sops services sops) #:export (base-operating-system)) (define* (base-operating-system host-name #:key (firmware (list linux-firmware))) @@ -130,3 +136,75 @@ ID with the extended system as it's value." (inherit base) (initrd-modules (append '("vmd") (operating-system-initrd-modules base)))))) + +(define-system oms-kone + (let ((base (base-operating-system "OMS-kone" + #:firmware (list ibt-hw-firmware iwlwifi-firmware))) + (wpa-psk (sops-secret + (key '("wpa-psk")) + (file (channel-file "sops/OMS-kone.yaml"))))) + (operating-system + (inherit base) + (kernel-arguments %default-kernel-arguments) + (swap-devices '()) + (services + (append + (list (service dhcpcd-service-type + (dhcpcd-configuration + (interfaces '("enp1s0")))) + (service dhcpd-service-type + (dhcpd-configuration + (interfaces '("wlp2s0")) + (config-file (channel-file "OMS-kone/dhcpd.conf")))) + (service dnsmasq-service-type + (dnsmasq-configuration + (listen-addresses '("192.168.1.1")))) + (service hostapd-service-type + (hostapd-configuration + (interface "wlp2s0") + (ssid "Samoojaverkko") ; muokatessa päivitä wpa_psk + (channel 1) + (extra-settings + (string-append "wpa=2\n" "wpa_psk_file=" + (sops-secret->secret-file wpa-psk))))) + (service nftables-service-type + (nftables-configuration + (ruleset (channel-file "OMS-kone/nftables.rules")))) + (service sops-secrets-service-type + (sops-service-configuration + (secrets (list wpa-psk)))) + (service static-networking-service-type + (list (static-networking + (provision '(wifi-ip)) + (addresses (list (network-address + (device "wlp2s0") + (value "192.168.1.1/24"))))))) + (service wireguard-service-type + (wireguard-configuration + (peers + (list + (wireguard-peer + (name "olarinmaensamoojat.fi") + (endpoint "olarinmaensamoojat.fi:51820") + (public-key "UT4RGKMzp61DYiiodsrvHc6m/tkSqLNo2wqxwACrdl4=") + (allowed-ips '("192.168.3.3/32")) + (keep-alive 25)))) + (addresses '("192.168.3.2/24")) + (private-key "/etc/wireguard/oms-kone.key") + (shepherd-requirement '(networking))))) + (modify-services (operating-system-user-services base) + (elogind-service-type config => + (elogind-configuration + (inherit config) + (handle-power-key 'ignore))) + (sysctl-service-type config => + (sysctl-configuration + (inherit config) + (settings (cons '("net.ipv4.ip_forward" . "1") + %default-sysctl-settings)))) + (gdm-service-type config => + (gdm-configuration + (inherit config) + (auto-suspend? #f))) + (delete network-manager-service-type) + (delete wpa-supplicant-service-type)))))))