Lisää kolon pöytäkoneen (ja reitittimen) käyttöjärjestelmä
This commit is contained in:
parent
e7bfd42108
commit
680ab0222d
GPG Key ID:
257D284A2A1D3A32
@ -4,6 +4,15 @@
|
|||||||
(keyring-reference "keyring")
|
(keyring-reference "keyring")
|
||||||
(url "https://git.olarinmaensamoojat.fi/OMS/tietokoneet.git")
|
(url "https://git.olarinmaensamoojat.fi/OMS/tietokoneet.git")
|
||||||
(dependencies
|
(dependencies
|
||||||
|
(channel
|
||||||
|
(name sops-guix)
|
||||||
|
(url "https://github.com/fishinthecalculator/sops-guix.git")
|
||||||
|
(branch "main")
|
||||||
|
(introduction
|
||||||
|
(channel-introduction
|
||||||
|
(version 0)
|
||||||
|
(commit "0bbaf1fdd25266c7df790f65640aaa01e6d2dbc9")
|
||||||
|
(signer "8D10 60B9 6BB8 292E 829B 7249 AED4 1CC1 93B7 01E2"))))
|
||||||
;; Ikävä kyllä OMSin tietokoneet tarvitsevat ei-vapaita laiteohjelmia
|
;; Ikävä kyllä OMSin tietokoneet tarvitsevat ei-vapaita laiteohjelmia
|
||||||
(channel
|
(channel
|
||||||
(name nonguix)
|
(name nonguix)
|
||||||
|
|||||||
@ -8,6 +8,16 @@
|
|||||||
"9edb3f66fd807b096b48283debdcddccfea34bad"
|
"9edb3f66fd807b096b48283debdcddccfea34bad"
|
||||||
(openpgp-fingerprint
|
(openpgp-fingerprint
|
||||||
"BBB0 2DDF 2CEA F6A8 0D1D E643 A2A0 6DF2 A33A 54FA"))))
|
"BBB0 2DDF 2CEA F6A8 0D1D E643 A2A0 6DF2 A33A 54FA"))))
|
||||||
|
(channel
|
||||||
|
(name 'sops-guix)
|
||||||
|
(url "https://github.com/fishinthecalculator/sops-guix.git")
|
||||||
|
(branch "main")
|
||||||
|
(commit "c53e27e533836ea8595626ba6796dee5362f8c4a")
|
||||||
|
(introduction
|
||||||
|
(make-channel-introduction
|
||||||
|
"0bbaf1fdd25266c7df790f65640aaa01e6d2dbc9"
|
||||||
|
(openpgp-fingerprint
|
||||||
|
"8D10 60B9 6BB8 292E 829B 7249 AED4 1CC1 93B7 01E2"))))
|
||||||
(channel
|
(channel
|
||||||
(name 'nonguix)
|
(name 'nonguix)
|
||||||
(url "https://gitlab.com/nonguix/nonguix")
|
(url "https://gitlab.com/nonguix/nonguix")
|
||||||
|
|||||||
@ -7,6 +7,15 @@
|
|||||||
"9edb3f66fd807b096b48283debdcddccfea34bad"
|
"9edb3f66fd807b096b48283debdcddccfea34bad"
|
||||||
(openpgp-fingerprint
|
(openpgp-fingerprint
|
||||||
"BBB0 2DDF 2CEA F6A8 0D1D E643 A2A0 6DF2 A33A 54FA"))))
|
"BBB0 2DDF 2CEA F6A8 0D1D E643 A2A0 6DF2 A33A 54FA"))))
|
||||||
|
(channel
|
||||||
|
(name 'sops-guix)
|
||||||
|
(url "https://github.com/fishinthecalculator/sops-guix.git")
|
||||||
|
(branch "main")
|
||||||
|
(introduction
|
||||||
|
(make-channel-introduction
|
||||||
|
"0bbaf1fdd25266c7df790f65640aaa01e6d2dbc9"
|
||||||
|
(openpgp-fingerprint
|
||||||
|
"8D10 60B9 6BB8 292E 829B 7249 AED4 1CC1 93B7 01E2"))))
|
||||||
(channel
|
(channel
|
||||||
(name 'nonguix)
|
(name 'nonguix)
|
||||||
(url "https://gitlab.com/nonguix/nonguix")
|
(url "https://gitlab.com/nonguix/nonguix")
|
||||||
|
|||||||
6
files/OMS-kone/dhcpd.conf
Normal file
6
files/OMS-kone/dhcpd.conf
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
option domain-name \"kolo.olarinmaensamoojat.fi\";
|
||||||
|
option domain-name-servers 192.168.1.1;
|
||||||
|
subnet 192.168.1.0 netmask 255.255.255.0 {
|
||||||
|
option routers 192.168.1.1;
|
||||||
|
range 192.168.1.100 192.168.1.240;
|
||||||
|
}
|
||||||
32
files/OMS-kone/nftables.rules
Normal file
32
files/OMS-kone/nftables.rules
Normal file
@ -0,0 +1,32 @@
|
|||||||
|
flush ruleset
|
||||||
|
|
||||||
|
table inet firewall_and_nat {
|
||||||
|
chain samoojaverkko_input {
|
||||||
|
accept
|
||||||
|
}
|
||||||
|
chain wireguard_input {
|
||||||
|
accept
|
||||||
|
}
|
||||||
|
chain input {
|
||||||
|
type filter hook input priority filter; policy drop;
|
||||||
|
iifname lo accept
|
||||||
|
ct state invalid drop
|
||||||
|
ct state { established, related } accept
|
||||||
|
iifname wlp2s0 jump samoojaverkko_input
|
||||||
|
iifname wg0 jump wireguard_input
|
||||||
|
}
|
||||||
|
chain forward {
|
||||||
|
type filter hook forward priority filter; policy drop;
|
||||||
|
ct state invalid drop
|
||||||
|
ct state { established, related } accept
|
||||||
|
iifname wlp2s0 accept
|
||||||
|
iifname wg0 accept
|
||||||
|
}
|
||||||
|
chain output {
|
||||||
|
type filter hook output priority filter; policy accept;
|
||||||
|
}
|
||||||
|
chain nat_masquerade {
|
||||||
|
type nat hook postrouting priority srcnat;
|
||||||
|
oifname enp1s0 ip saddr 192.168.0.0/16 masquerade
|
||||||
|
}
|
||||||
|
}
|
||||||
10
files/sops/.sops.yaml
Normal file
10
files/sops/.sops.yaml
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
keys:
|
||||||
|
- &saku-laesvuori A0C91947734F076F5F08E9FF257D284A2A1D3A32
|
||||||
|
- &OMS-kone D70ADEB8DFCC7DDB13B83E9B60E9442BA424EBD3
|
||||||
|
|
||||||
|
creation_rules:
|
||||||
|
- path_regex: ^OMS-kone.yaml$
|
||||||
|
key_groups:
|
||||||
|
- pgp:
|
||||||
|
- *saku-laesvuori
|
||||||
|
- *OMS-kone
|
||||||
42
files/sops/OMS-kone.yaml
Normal file
42
files/sops/OMS-kone.yaml
Normal file
@ -0,0 +1,42 @@
|
|||||||
|
#ENC[AES256_GCM,data:GCmBPDuXu5IFMFaajxDqJYs2yTs=,iv:kPnHq9jv1E8gr48sv5QiDGPq+QZVxlcG0cITwC7FXFM=,tag:ED+rzah7ELjTouJAEErRag==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:ITRmubrQRL6H5LBQttJmsOGnEA==,iv:Qb8ChChkrgew79iOQGFYdz42Z1pM6BLVME01OwlLfuw=,tag:F7xoOJ+xtWxmVY19Z8mefw==,type:comment]
|
||||||
|
#ENC[AES256_GCM,data:hFjd28QRs4n5yulbo26Ohd0GHX/Dzpw7Sh/Ts4eZfGsr7RPFAot0OmamHt4Qpdz2kpivHdqO/0a7,iv:wBCY9TDW6VsCyJ7h8G/1NdCAYSnKRJhjOJFryZwhEL0=,tag:PcYkwsv4MJd9E8kwX2xNJw==,type:comment]
|
||||||
|
wpa-psk: ENC[AES256_GCM,data:kn/SkxD2YSHXS8VrskE8GdW5GmCGIxkczoXiInJagcRWuq/xE7JDFRdaT9p/SBRbRESOzCvP7dzbCeoQ7h6Hpg==,iv:qZtAPVzjDCJ8En33c7n3dG0UiQK1VkNHMRtw6VBvtQ0=,tag:B88Vg5oFn8XjhAwUiClaSA==,type:str]
|
||||||
|
sops:
|
||||||
|
lastmodified: "2026-08-12T13:56:49Z"
|
||||||
|
mac: ENC[AES256_GCM,data:MY/ZEi/MzwHPSwTeXsnufRjf3hOs+zDtD8nPTTBbFOh+Xaes64wDI0hgIFn/RwKyMvwI0XIeA4dZ/UWsvZe5CId64JtJ5dxcmB9hUozIdtIT+20bmfhOFG7ww5X/5wimw9BjMjfP/hX+owB5G78LCa8dmNMkHEmybfK4WfwmC8c=,iv:lHO1bn+7mXtbRacj7qoVPIZyOe1BmShXIRFvUWf0MB0=,tag:MyC7ilGZwASppPhQZ2Fl3Q==,type:str]
|
||||||
|
pgp:
|
||||||
|
- created_at: "2026-08-12T13:05:39Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA/QlAv6mQqxoARAAm/Q4hyhJ797BpoydN6HcI8olVVXZvp3oQ0WxILt1wH5N
|
||||||
|
7E6JfAEzxzdpEC/2lyS+IORMnLgkhJzlBTv2Wd34mlWeZ08EnhmMpMBHBeUWj6Ah
|
||||||
|
bKJFxfPb2MqcHBm1CLft/ei7mOVnnEb6qzzkXhWFFhxb34e8HCn0oIgREGqpBv6q
|
||||||
|
BQNFYmt9IOQOFvmfnYhppBRL/UyaWENs0veINncmY36ElsFAfb2dpPqJbeEXKnJG
|
||||||
|
+78nUOpctKfKDe16RPHLuiFWKMfzamciPBO0j1YoJo4wh8zoe1l6A0Ar4yFpgpL3
|
||||||
|
4KpNdwZrNjzBH2GTMQ8LdZjnWVcX2V5ZQ3I/srWHSKqFl/Q/pXclSCecV9afZzV1
|
||||||
|
sAvwg1T/WCpJ82LGfJBnYMB2EGhmIAkMCV1tpAacK1MN5rHcuJak3wvRVm7RfEP7
|
||||||
|
n6YoQU7XUkXgsw9rg9tuWt90T3O6Z5PC6f3YtZ4K+yVrA90OKxLhmLxjCnPINikT
|
||||||
|
2rP3biMge5eUplReUtObuxuNr+qVyaKPLPxaW2gBzQ+wjE2O2X2p5McQTGRzh+hi
|
||||||
|
N7foCjniEzQapjV6cjjKwBJS8l+tYxYfuA4yGSJN5O4zc5KgQwP8Lq1ExvYu1hol
|
||||||
|
1XUDjjn46zUzLDvGP7bu/21NOY8e1lKd04fYFUn5czx1MlyrDpmp54zxvKgr+urS
|
||||||
|
XAHQSDnaDhh+2s203YL/j2CSs1oNEbN7ctEaqlvoXhAeGmMAAowFDW9eR3HPtnus
|
||||||
|
65nH3OaXgUIFlARaLYpJl8/pbB06C24qRLah3jaX3dTSFigTv77DyE3ZeUZe
|
||||||
|
=ttg1
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: A0C91947734F076F5F08E9FF257D284A2A1D3A32
|
||||||
|
- created_at: "2026-08-12T13:05:39Z"
|
||||||
|
enc: |-
|
||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hF4Du53yw99JEwQSAQdApGSh5Fbt0y9PGIF6MLk1JkaF4anF9r434ezd9Dj+Gkcw
|
||||||
|
QjMFXhGR/l/QVw1q5Rkwac1FgNpevuWwlupAzmXsD3/yViM+8OwV/+RBCDSSzyUE
|
||||||
|
1GYBCQIQ6gI3gx5E3G1mjLwiSzh6zCxfgpYXeX+desnsgsldj/zkYLnMteTHy7/x
|
||||||
|
/BsURV7CyK6sT/B6okxq1H/lZV3Xr15kvMIc8t44XYkFq+2eyIn5BAOZDLqTZ8Tx
|
||||||
|
EZEc6BiaE7U=
|
||||||
|
=5mFp
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
|
fp: D70ADEB8DFCC7DDB13B83E9B60E9442BA424EBD3
|
||||||
|
unencrypted_suffix: _unencrypted
|
||||||
|
version: 3.12.2
|
||||||
48
files/sops/README.md
Normal file
48
files/sops/README.md
Normal file
@ -0,0 +1,48 @@
|
|||||||
|
# Guix SOPS -salaisuuksienhallinta
|
||||||
|
|
||||||
|
<https://github.com/fishinthecalculator/sops-guix>
|
||||||
|
|
||||||
|
## Uuden laitteen lisääminen
|
||||||
|
|
||||||
|
Jokaiselle salaisuuksia tarvitsevalle laitteelle luodaan oma PGP-salausavain
|
||||||
|
seuraavan kaltaisella komennolla. Olennaista on, että avaimella ei ole
|
||||||
|
salasanaa eikä se vanhene.
|
||||||
|
|
||||||
|
```
|
||||||
|
gpg --batch --passphrase '' --quick-generate-key \
|
||||||
|
'(SOPS Guix -salauksen purkamiseen) <root@LAITE>' default default never
|
||||||
|
```
|
||||||
|
|
||||||
|
Tämän avaimen yksityinen osa tallennetaan salattuna kaikille ylläpitäjille
|
||||||
|
hakemistoon `host-decryption-keys` käyttämällä apuna `./encrypt-private-key.sh`
|
||||||
|
komentokyhäelmää. Kyhäelmä hakee ylläpitäjien julkiset salausavaimet
|
||||||
|
hakemistosta `./admin-encryption-keys`.
|
||||||
|
|
||||||
|
```
|
||||||
|
gpg --export-secret-keys root@LAITE | ./encrypt-private-key.sh > host-decryption-keys/LAITE.key.gpg
|
||||||
|
```
|
||||||
|
|
||||||
|
Lisäksi yksityinen avain viedään laitteen `root`-käyttäjän avainrenkaaseen.
|
||||||
|
|
||||||
|
```
|
||||||
|
gpg --decrypt < host-decryption-keys/LAITE.key.gpg | ssh root@LAITE 'gpg --import'
|
||||||
|
```
|
||||||
|
|
||||||
|
Avaimen tunniste lisätään salaisuuksienhallinan ohjaustiedostoon `sops.yaml`
|
||||||
|
omalle rivilleen kohtaan `keys`. Tunnisteen saa näkyviin ajamalla komennon
|
||||||
|
`gpg --list-keys root@LAITE`. Kun kaikki ylläolevista on tehty, laitteelle voi
|
||||||
|
asentaa salaisuuksia.
|
||||||
|
|
||||||
|
## Uuden ylläpitäjän lisääminen
|
||||||
|
|
||||||
|
Ylläpitäjä tarvitsee oman PGP-salausavaimensa, jonka voi luoda esimerkiksi
|
||||||
|
GnuPG:llä komennolla `gpg --generate-key`. Avaimen julkinen eli salauspuoli
|
||||||
|
tallennetaan hakemistoon `./admin-encryption-keys` muita ylläpitäjiä varten.
|
||||||
|
|
||||||
|
```
|
||||||
|
gpg --armor --export AVAIN > admin-encryption-keys/YLLÄPITÄJÄ.pub
|
||||||
|
```
|
||||||
|
|
||||||
|
Lisäksi avaimen tunniste pitää lisätä `sops.yaml`-tiedostoon. Jonkun aiemman
|
||||||
|
ylläpitäjän pitää lisätä uusi tiedostojen salausryhmiin ja salata tiedostot
|
||||||
|
uudelleen ennen kuin ne ovat hänen luettavissaan.
|
||||||
52
files/sops/admin-encryption-keys/saku-laesvuori.pub
Normal file
52
files/sops/admin-encryption-keys/saku-laesvuori.pub
Normal file
@ -0,0 +1,52 @@
|
|||||||
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||||
|
|
||||||
|
mQINBGCJJvcBEADEsx42OdBcdslRop/VYmEe/KMAEo5zN7mKapZeS8ZeR3dvgxUh
|
||||||
|
3c4uIv8LoWHPbBdnslL8FhSzjxn7L11QOfLwzgdzoMqjVUJJaggvukhkjJXl5mja
|
||||||
|
Yzta5/zmUGVgruHlsqFcJcnICnOgCCZDAVjSw/rTbkd2RN1oVte0b3MCZUv7A3Xi
|
||||||
|
Z6yCrWL0yQikGIQi1CBvdTbca1aUMuhgpyaq1SCUfbe+oq4jc2mvnVsIZucDs48U
|
||||||
|
ofayLDye0GsjOo2vyPRalBq1XhA1hoQYtfdqcENyiMAumfnzJ24ou+YRd2RXPKcc
|
||||||
|
dy9FQrhL7hLwp+bewPXbrObgCiV2NyussShFe/m6C0A6RFBLSfG+dTFt4F/joWei
|
||||||
|
yJmjt6FIRpHvTEjluvpn3ApO4JmlxBlTIUBcgJJp/UQ+IUSYEOAdoOw9RGn1sNG8
|
||||||
|
uN++AvQXZZyFCMFrd1amJd6rjqVvIyc7DGyilmBF7os2p/iss+sQWdlAKuZQU6Zv
|
||||||
|
xFR3Ltl+qhYNATSuKh9z7VdSiBLCJEHam4htdduwRroh5gXjQjAaLNPDihBLV46Q
|
||||||
|
Oz3iI6gZbF3+QQy03hqXXc9W98tfd/nXgepD2S8SZPCmY3SY7JI9E98HGH7JiHeg
|
||||||
|
cpOfK9Knn5NGfH92PyOjRnowvsNHLsR1VsmlNovk5wkNfRRPg5TBRDXcMQARAQAB
|
||||||
|
tCJTYWt1IExhZXN2dW9yaSA8c2FrdUBsYWVzdnVvcmkuZmk+iQJXBBMBCgBBAhsD
|
||||||
|
BQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAhkBFiEEoMkZR3NPB29fCOn/JX0oSiod
|
||||||
|
OjIFAmlX1uAFCQqv42kACgkQJX0oSiodOjK0Gw/9EktRq8Uip53fzMr8MeTm/qcm
|
||||||
|
aO8/dlYIAF4i+QjGWrHTv6PfP8lFLEm/Q+AktvjKhvOzIJA1tGKHGZWnQMLwDNx2
|
||||||
|
uEBaStoHI9sXFH73Sqb/sopcbY9z7tV6fRHxMYwAnCgwjgxT4C6Q/gs9EG2z7Jjg
|
||||||
|
TXUklHXjKavnviLDP+G4M4ce3JlHR/RhAtX6M23mmvRSGBdDBsJ1kC8ot1xSnJNo
|
||||||
|
Xo6LSpA994OJyQ5c7EFqSsBU0E2Vp/7hgT2vBufZg9oVsEjmPBrLHPcEPt6qu3lr
|
||||||
|
mNjDgDWM6poopelqnn3+GTNaLGi20JDz/8S+X+X0v4YLevSFgBseATtB0nFngQ4X
|
||||||
|
nnkRvfVZWMQUUF7K8RCbtfLREy84WfEhPy7hVzbyuYhynTpvD3chCLoyWjXPV70X
|
||||||
|
BggdKDJLeVUBFXk2kZ+qQiwFeSv++/FSgIQgwRJiVB0eVNLPCdcWXr5kcel2gbEe
|
||||||
|
C17T/z6DJiXMjrrht3vdm+g7K0jAk7UaIr/oBxEYPkJoru1N811YAk0Rys1+cHqe
|
||||||
|
6swARZrdpYaBY831XJ77nuVjAqBR0JGKaW1UaPsK0ykzbIa30SNaIqt0cFBDjqbG
|
||||||
|
ia3LQ/is1UqRyiJXdS47/WBGKt6mAj+OhW7fnl1Ps2YglGh+4ZehvpRdEVBG6pM/
|
||||||
|
ciOkn08eT+cOey8KpxS5Ag0EYIkm9wEQAL3qGd774FTzLFqjJICQWYisCBst07Tf
|
||||||
|
4aVKRJEQZkKnWNOQzQltSa5nHRLVtdEvvbejK+Ci8/l2yI58PkqkbKlL9K/IRgHn
|
||||||
|
8xqxWVcirbDZq32g5SI0zSa1B296o12TJrKGBSGBcAI0NRUaSUJmGy4HvIGdf8oV
|
||||||
|
xqvNDKL4I2igf5Kj3mMOZzFjbOr17SUetF72W1w5BAqLWX32YVXnC/RHP7WRuFv7
|
||||||
|
LLpsAHOgnInQ44BF8WQdxnliJr18Pz/kyW/otMsVq4OxNMwYTiRDqBmDNPZmLHTd
|
||||||
|
thXvb41pI95Opk/th/8xc3+w1wAfcrx/vRccvfgr0nN4q4mqKAZSp4qJQocGF8xf
|
||||||
|
JGc0CurTdQwQT2yWEmoVIqoQLTJOhX8NuC9JI/U8b2riRMcAVU37pzHWxUepsbH/
|
||||||
|
rEVYbVSaSRLVKTNCOmDSvOtQ7LZBHvAoVGG7Zzoluqg0X2GqrdCyCaBdFBgWOlw8
|
||||||
|
/2q+dR6JxMXcmSDxAJuZgI2oR4bTSXPbQT5ezqSq/71g2+CKw5me4KEOoZiuAVOS
|
||||||
|
vMv05wU3/s3yJpCYK5OMsBgRaSWE7+QIQjr4+467/Bxo3mP5eIgKA6M67qT89TIK
|
||||||
|
VSALA14mCnc991fW67ib9Y4Sx9ZtHvaYL5i6tZ143ShTfsfifpyoZt0LhA8CL3Ac
|
||||||
|
W6wpqdgcIoWPABEBAAGJAjwEGAEKACYCGwwWIQSgyRlHc08Hb18I6f8lfShKKh06
|
||||||
|
MgUCaVfbzwUJCq/oWAAKCRAlfShKKh06MjjPEACjw1+ZuXLpQYj4ZSkpq6iL2LoJ
|
||||||
|
AyxmxHUKeZDGMhyyf+Tt06l+cY2Gj2fGfSlRawDbfaoVoVV3crH0dzwUh3FeIfMM
|
||||||
|
6Xj1h1hsUJhFxKkaLSd1jfyf3ycuJ/XoxACt+gVEW6/EkOQMRI6gAjPJDYmh2a5K
|
||||||
|
WmArWJXzUk0RIQ147qbi0EdcI5FUIUj1hGvrwjXhfsbdbwH8gm1fQ/6iKr9EilLS
|
||||||
|
pmmAmaTMtmz0GfUi95ksV1tQF8wTogDcUE2LHCfZLz9fXqh3JKkdl5uXcrJYjFRk
|
||||||
|
A16/1aiL5RhEaNcIj6luiuhRZ1wLGdW2eSw0yeCIkxgwY1/C8oJze2V4Gybywcof
|
||||||
|
cZNs4gDFxqCM65H+17f8oTIeuQ0Wuphxde2F7Gy8M2/RBSm9750Mx8sx4qyjUqXb
|
||||||
|
OIMM1NeuRlY2pehHbhgPTiVFfDkFrY8mYLAMeW5txUrfs/m+ocu0sDau/rInX6uP
|
||||||
|
mezxbJ5z182OLIkDLB1XaN/ThZbJbsB4TjXNrXjk40UgwLEwJ07jA2uZcgRCpwzJ
|
||||||
|
OEvEr9u56z0fQCAlQTfTNCbndzZXBygtayg2CfhDg7gI/d/nLm2xqx6ZaFVGQEz1
|
||||||
|
kiuzcsLPmeu7zI9ehSui6o7g77q2e2sq96OVvTzX3m0Iyqip+Y3If7pT3CZBvsXe
|
||||||
|
8WXUYb+YeXxijAcFcQ==
|
||||||
|
=AmUD
|
||||||
|
-----END PGP PUBLIC KEY BLOCK-----
|
||||||
9
files/sops/encrypt-private-key.sh
Executable file
9
files/sops/encrypt-private-key.sh
Executable file
@ -0,0 +1,9 @@
|
|||||||
|
#!/usr/bin/env sh
|
||||||
|
|
||||||
|
recipients=""
|
||||||
|
|
||||||
|
for key in admin-encryption-keys/*; do
|
||||||
|
recipients="--recipient-file $key $recipients";
|
||||||
|
done
|
||||||
|
|
||||||
|
gpg --encrypt --armor $recipients "$@"
|
||||||
40
files/sops/host-decryption-keys/OMS-kone.key.gpg
Normal file
40
files/sops/host-decryption-keys/OMS-kone.key.gpg
Normal file
@ -0,0 +1,40 @@
|
|||||||
|
-----BEGIN PGP MESSAGE-----
|
||||||
|
|
||||||
|
hQIMA/QlAv6mQqxoAQ/+IxiRZ13lM9CT7lwB9Ewpge+C1BPls9oKbsP0SGljHioQ
|
||||||
|
zDV87YewbECrDuw6MzYxBtig5vbNMfpy9y78f34U4R7ICQ450SpqpCzz6V1C6mVb
|
||||||
|
aZxz16IvS1cniQkqY0NFXczuiLteGCFn6Q3S9s35OWWk/PCVibs4npTI+zKGOvw9
|
||||||
|
BoQbn8eo5y4zdcxhFvYZzzkypNjxHY+++HcyXesNvMgTzcNDnwjkzyFGxcsN9CtC
|
||||||
|
0HIy7sfxXy9hIWj9KHf9gIdZKRaH+1/7W90h+UimJcvDuyEe9+t7VkQHY8l5aihf
|
||||||
|
5TOgeE+Lr3WgaiZnYUPbyUn66bzgSk9gpr04TpnTTj2txo1Unvb8TbKmqjT5xHP2
|
||||||
|
ds/tVw3sBdRjMHS0LSpD+gJmn97ZIKfSmSPGfXnvKU/frLF/oIm9tUnU1W1fDNX4
|
||||||
|
eBNZUwicXL8JSrjjKEYlUwUjqpnezUuns2WH6Tm3npa+rGS9gVcf1fYq8YCgcBvB
|
||||||
|
i4LEMFFCTrHrMI/VkG8H7nLG69olf9gjglrKjC+ddpzDarC1iZVX0g/hJRGaoql6
|
||||||
|
iIqtNRPAYv4iV484t4xyzMVGra5RIFhYS9wknbgVyPkB9AuDBfttuV/8hSv08m5s
|
||||||
|
5WjTY4zULV2KPPL3mLVBat5B/MPkOwkifMlYqgULx7nWe/6c+7NGRb6V/fsQB6nS
|
||||||
|
6gH4DduuI5fX7LIcx8sLjEB3nQju5BquYehjf9WGUOD2WuvdPJxyfmsZ5Rd9ky7H
|
||||||
|
fjhvHuoDybqMyjb/e8DAyhVWmVQpJfWQnZIXua5I55sr1cq2KhQzG/1SgKiGGam+
|
||||||
|
yHXksNNyy/koUOmUhByKu9eozUj8+TJfJzi0hHN7kTARntiLaBeAeilqQpCocdCR
|
||||||
|
/VQFKfHEKSGaYt28SsAXCri59zzS4deq5Yp/NuNEFCDyr2oYiX4gjcHUH2dqU9py
|
||||||
|
msFBSj3eaXMB3rFTOwDpW9Umo/3+ji3D4zMFmBDOV4G0qEDCKO9rHVGwgevojrO6
|
||||||
|
DNU5hVj/xh6DNCewQ/fbQKAcbGdvJCN7eZIlEs0Kq9JJQL/R8Qa6C2PD9VrQ/Ezn
|
||||||
|
K+8umVe/+DSDDMvdv3KmVd2y/u8yRLc6Jcx1AyAMQg59PeBkYC5qWl+/mzTPediy
|
||||||
|
Eq1CaM/ojcqYR0RS+kANJMxXSWaxecPt0hVGFtHa4Ra2464fcolZX2STr04ZYV17
|
||||||
|
G3O7vuDEVWFZ35cjH7i+vtqK4XxdDkqq8CuXhbBjov3i1IDcUu9j8UJMRhzvqS7N
|
||||||
|
OQWqK7rejLy7Yg5dQBDUokOHWWTXsO3WjwNHN4FQZ1BY8Uy3UDXoJX+69N00XAIp
|
||||||
|
gplViNc5qDT2UCgCUGDN3viCtF/u3oSz87HgD+TgGEAWtabjxoHxhmzDea6HyzB+
|
||||||
|
QGJuGVR1Jbbl+CAHBIa897ej3dRz25NBNFlYPwbHf6BNQq9gZZ35Vw+3LMMgS1a0
|
||||||
|
tEaWKRzlkdFo2kH1Im+8s4l6Wj9KDOqSu+djpzwtayorI9Bi3tlfe5K8uGWFCH7C
|
||||||
|
HjHXApdFG4Y/faJEYPl866396K32XqbGBWG/43VO+XZLYrQvp4fKuuruGlpqDZHc
|
||||||
|
pW1eSkBiBYiu2apn+GeJwnczH7ZNZKdU3XiS2niAH2onXgjHxSbfknSm7HqqkHdh
|
||||||
|
yph03teQn+hJSF96hXwgcJoBTQ6OZiqzliXEj1pDlcHJAQa11K8Vd1iBzgJwD/n0
|
||||||
|
eQDtz0AQTobmBLs84DZgT/+q8GOFhNjwwuaY1iOP7fyJ6fgthxDVUv5p2ea/UTnb
|
||||||
|
8e00d1oh8DAbJgJOVEOkqabdZH9l0m+Mh8As3Z7ISVJ/FXInGTM5nR7VRwq3tRUd
|
||||||
|
9lT5ECD73ojmYEr8TLkvsmtCknLMn+H1B09kI2wrgBIgTojOt5A2a4XAO3OGhQ3O
|
||||||
|
75FbzelKvRzLwf5wULkoMXZEKJ8NLiEG9WJKrcetY4s9NTgJl81GOBpo9NrRXtxZ
|
||||||
|
H9xBKXngaMQEWKQXcuoIKzOQCQcLPE9fitMWHSVGe9DcJK4H6nJKZtotNh1B1CtE
|
||||||
|
czmmlbyiMenZp65kQ1Bo3OWTXUBLcKAP7fEkuNfgOFOTC/cbRgT/KMyCk2QZpeO3
|
||||||
|
TvF8Va3DwIfAda1JNvBqimJLZxOvH2SP2sHBer2N5M50xb8filhy3GflbNFaCBmv
|
||||||
|
FUH6OLFWpWbanoEDx57vWkTZlTN2IvtV3WlOEAweFbmaO4LzOWH3zFJ8zOkzenr/
|
||||||
|
PMDALdN2jfmnxE/zJvYD82TbanNy
|
||||||
|
=PuIl
|
||||||
|
-----END PGP MESSAGE-----
|
||||||
1
manifest.scm
Normal file
1
manifest.scm
Normal file
@ -0,0 +1 @@
|
|||||||
|
(specifications->manifest (list "sops" "wpa-supplicant"))
|
||||||
@ -5,13 +5,19 @@
|
|||||||
#:use-module (gnu services base)
|
#:use-module (gnu services base)
|
||||||
#:use-module (gnu services cups)
|
#:use-module (gnu services cups)
|
||||||
#:use-module (gnu services desktop)
|
#:use-module (gnu services desktop)
|
||||||
|
#:use-module (gnu services dns)
|
||||||
#:use-module (gnu services guix)
|
#:use-module (gnu services guix)
|
||||||
|
#:use-module (gnu services networking)
|
||||||
#:use-module (gnu services ssh)
|
#:use-module (gnu services ssh)
|
||||||
|
#:use-module (gnu services sysctl)
|
||||||
|
#:use-module (gnu services vpn)
|
||||||
#:use-module (gnu services xorg)
|
#:use-module (gnu services xorg)
|
||||||
#:use-module (guix gexp)
|
#:use-module (guix gexp)
|
||||||
#:use-module (nongnu packages linux)
|
#:use-module (nongnu packages linux)
|
||||||
#:use-module (nongnu system linux-initrd)
|
#:use-module (nongnu system linux-initrd)
|
||||||
#:use-module (oms channel-file)
|
#:use-module (oms channel-file)
|
||||||
|
#:use-module (sops secrets)
|
||||||
|
#:use-module (sops services sops)
|
||||||
#:export (base-operating-system))
|
#:export (base-operating-system))
|
||||||
|
|
||||||
(define* (base-operating-system host-name #:key (firmware (list linux-firmware)))
|
(define* (base-operating-system host-name #:key (firmware (list linux-firmware)))
|
||||||
@ -130,3 +136,75 @@ ID with the extended system as it's value."
|
|||||||
(inherit base)
|
(inherit base)
|
||||||
(initrd-modules
|
(initrd-modules
|
||||||
(append '("vmd") (operating-system-initrd-modules base))))))
|
(append '("vmd") (operating-system-initrd-modules base))))))
|
||||||
|
|
||||||
|
(define-system oms-kone
|
||||||
|
(let ((base (base-operating-system "OMS-kone"
|
||||||
|
#:firmware (list ibt-hw-firmware iwlwifi-firmware)))
|
||||||
|
(wpa-psk (sops-secret
|
||||||
|
(key '("wpa-psk"))
|
||||||
|
(file (channel-file "sops/OMS-kone.yaml")))))
|
||||||
|
(operating-system
|
||||||
|
(inherit base)
|
||||||
|
(kernel-arguments %default-kernel-arguments)
|
||||||
|
(swap-devices '())
|
||||||
|
(services
|
||||||
|
(append
|
||||||
|
(list (service dhcpcd-service-type
|
||||||
|
(dhcpcd-configuration
|
||||||
|
(interfaces '("enp1s0"))))
|
||||||
|
(service dhcpd-service-type
|
||||||
|
(dhcpd-configuration
|
||||||
|
(interfaces '("wlp2s0"))
|
||||||
|
(config-file (channel-file "OMS-kone/dhcpd.conf"))))
|
||||||
|
(service dnsmasq-service-type
|
||||||
|
(dnsmasq-configuration
|
||||||
|
(listen-addresses '("192.168.1.1"))))
|
||||||
|
(service hostapd-service-type
|
||||||
|
(hostapd-configuration
|
||||||
|
(interface "wlp2s0")
|
||||||
|
(ssid "Samoojaverkko") ; muokatessa päivitä wpa_psk
|
||||||
|
(channel 1)
|
||||||
|
(extra-settings
|
||||||
|
(string-append "wpa=2\n" "wpa_psk_file="
|
||||||
|
(sops-secret->secret-file wpa-psk)))))
|
||||||
|
(service nftables-service-type
|
||||||
|
(nftables-configuration
|
||||||
|
(ruleset (channel-file "OMS-kone/nftables.rules"))))
|
||||||
|
(service sops-secrets-service-type
|
||||||
|
(sops-service-configuration
|
||||||
|
(secrets (list wpa-psk))))
|
||||||
|
(service static-networking-service-type
|
||||||
|
(list (static-networking
|
||||||
|
(provision '(wifi-ip))
|
||||||
|
(addresses (list (network-address
|
||||||
|
(device "wlp2s0")
|
||||||
|
(value "192.168.1.1/24")))))))
|
||||||
|
(service wireguard-service-type
|
||||||
|
(wireguard-configuration
|
||||||
|
(peers
|
||||||
|
(list
|
||||||
|
(wireguard-peer
|
||||||
|
(name "olarinmaensamoojat.fi")
|
||||||
|
(endpoint "olarinmaensamoojat.fi:51820")
|
||||||
|
(public-key "UT4RGKMzp61DYiiodsrvHc6m/tkSqLNo2wqxwACrdl4=")
|
||||||
|
(allowed-ips '("192.168.3.3/32"))
|
||||||
|
(keep-alive 25))))
|
||||||
|
(addresses '("192.168.3.2/24"))
|
||||||
|
(private-key "/etc/wireguard/oms-kone.key")
|
||||||
|
(shepherd-requirement '(networking)))))
|
||||||
|
(modify-services (operating-system-user-services base)
|
||||||
|
(elogind-service-type config =>
|
||||||
|
(elogind-configuration
|
||||||
|
(inherit config)
|
||||||
|
(handle-power-key 'ignore)))
|
||||||
|
(sysctl-service-type config =>
|
||||||
|
(sysctl-configuration
|
||||||
|
(inherit config)
|
||||||
|
(settings (cons '("net.ipv4.ip_forward" . "1")
|
||||||
|
%default-sysctl-settings))))
|
||||||
|
(gdm-service-type config =>
|
||||||
|
(gdm-configuration
|
||||||
|
(inherit config)
|
||||||
|
(auto-suspend? #f)))
|
||||||
|
(delete network-manager-service-type)
|
||||||
|
(delete wpa-supplicant-service-type)))))))
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user