Lisää kolon pöytäkoneen (ja reitittimen) käyttöjärjestelmä
This commit is contained in:
parent
e7bfd42108
commit
680ab0222d
GPG Key ID:
257D284A2A1D3A32
@ -4,6 +4,15 @@
|
||||
(keyring-reference "keyring")
|
||||
(url "https://git.olarinmaensamoojat.fi/OMS/tietokoneet.git")
|
||||
(dependencies
|
||||
(channel
|
||||
(name sops-guix)
|
||||
(url "https://github.com/fishinthecalculator/sops-guix.git")
|
||||
(branch "main")
|
||||
(introduction
|
||||
(channel-introduction
|
||||
(version 0)
|
||||
(commit "0bbaf1fdd25266c7df790f65640aaa01e6d2dbc9")
|
||||
(signer "8D10 60B9 6BB8 292E 829B 7249 AED4 1CC1 93B7 01E2"))))
|
||||
;; Ikävä kyllä OMSin tietokoneet tarvitsevat ei-vapaita laiteohjelmia
|
||||
(channel
|
||||
(name nonguix)
|
||||
|
||||
@ -8,6 +8,16 @@
|
||||
"9edb3f66fd807b096b48283debdcddccfea34bad"
|
||||
(openpgp-fingerprint
|
||||
"BBB0 2DDF 2CEA F6A8 0D1D E643 A2A0 6DF2 A33A 54FA"))))
|
||||
(channel
|
||||
(name 'sops-guix)
|
||||
(url "https://github.com/fishinthecalculator/sops-guix.git")
|
||||
(branch "main")
|
||||
(commit "c53e27e533836ea8595626ba6796dee5362f8c4a")
|
||||
(introduction
|
||||
(make-channel-introduction
|
||||
"0bbaf1fdd25266c7df790f65640aaa01e6d2dbc9"
|
||||
(openpgp-fingerprint
|
||||
"8D10 60B9 6BB8 292E 829B 7249 AED4 1CC1 93B7 01E2"))))
|
||||
(channel
|
||||
(name 'nonguix)
|
||||
(url "https://gitlab.com/nonguix/nonguix")
|
||||
|
||||
@ -7,6 +7,15 @@
|
||||
"9edb3f66fd807b096b48283debdcddccfea34bad"
|
||||
(openpgp-fingerprint
|
||||
"BBB0 2DDF 2CEA F6A8 0D1D E643 A2A0 6DF2 A33A 54FA"))))
|
||||
(channel
|
||||
(name 'sops-guix)
|
||||
(url "https://github.com/fishinthecalculator/sops-guix.git")
|
||||
(branch "main")
|
||||
(introduction
|
||||
(make-channel-introduction
|
||||
"0bbaf1fdd25266c7df790f65640aaa01e6d2dbc9"
|
||||
(openpgp-fingerprint
|
||||
"8D10 60B9 6BB8 292E 829B 7249 AED4 1CC1 93B7 01E2"))))
|
||||
(channel
|
||||
(name 'nonguix)
|
||||
(url "https://gitlab.com/nonguix/nonguix")
|
||||
|
||||
6
files/OMS-kone/dhcpd.conf
Normal file
6
files/OMS-kone/dhcpd.conf
Normal file
@ -0,0 +1,6 @@
|
||||
option domain-name \"kolo.olarinmaensamoojat.fi\";
|
||||
option domain-name-servers 192.168.1.1;
|
||||
subnet 192.168.1.0 netmask 255.255.255.0 {
|
||||
option routers 192.168.1.1;
|
||||
range 192.168.1.100 192.168.1.240;
|
||||
}
|
||||
32
files/OMS-kone/nftables.rules
Normal file
32
files/OMS-kone/nftables.rules
Normal file
@ -0,0 +1,32 @@
|
||||
flush ruleset
|
||||
|
||||
table inet firewall_and_nat {
|
||||
chain samoojaverkko_input {
|
||||
accept
|
||||
}
|
||||
chain wireguard_input {
|
||||
accept
|
||||
}
|
||||
chain input {
|
||||
type filter hook input priority filter; policy drop;
|
||||
iifname lo accept
|
||||
ct state invalid drop
|
||||
ct state { established, related } accept
|
||||
iifname wlp2s0 jump samoojaverkko_input
|
||||
iifname wg0 jump wireguard_input
|
||||
}
|
||||
chain forward {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
ct state invalid drop
|
||||
ct state { established, related } accept
|
||||
iifname wlp2s0 accept
|
||||
iifname wg0 accept
|
||||
}
|
||||
chain output {
|
||||
type filter hook output priority filter; policy accept;
|
||||
}
|
||||
chain nat_masquerade {
|
||||
type nat hook postrouting priority srcnat;
|
||||
oifname enp1s0 ip saddr 192.168.0.0/16 masquerade
|
||||
}
|
||||
}
|
||||
10
files/sops/.sops.yaml
Normal file
10
files/sops/.sops.yaml
Normal file
@ -0,0 +1,10 @@
|
||||
keys:
|
||||
- &saku-laesvuori A0C91947734F076F5F08E9FF257D284A2A1D3A32
|
||||
- &OMS-kone D70ADEB8DFCC7DDB13B83E9B60E9442BA424EBD3
|
||||
|
||||
creation_rules:
|
||||
- path_regex: ^OMS-kone.yaml$
|
||||
key_groups:
|
||||
- pgp:
|
||||
- *saku-laesvuori
|
||||
- *OMS-kone
|
||||
42
files/sops/OMS-kone.yaml
Normal file
42
files/sops/OMS-kone.yaml
Normal file
@ -0,0 +1,42 @@
|
||||
#ENC[AES256_GCM,data:GCmBPDuXu5IFMFaajxDqJYs2yTs=,iv:kPnHq9jv1E8gr48sv5QiDGPq+QZVxlcG0cITwC7FXFM=,tag:ED+rzah7ELjTouJAEErRag==,type:comment]
|
||||
#ENC[AES256_GCM,data:ITRmubrQRL6H5LBQttJmsOGnEA==,iv:Qb8ChChkrgew79iOQGFYdz42Z1pM6BLVME01OwlLfuw=,tag:F7xoOJ+xtWxmVY19Z8mefw==,type:comment]
|
||||
#ENC[AES256_GCM,data:hFjd28QRs4n5yulbo26Ohd0GHX/Dzpw7Sh/Ts4eZfGsr7RPFAot0OmamHt4Qpdz2kpivHdqO/0a7,iv:wBCY9TDW6VsCyJ7h8G/1NdCAYSnKRJhjOJFryZwhEL0=,tag:PcYkwsv4MJd9E8kwX2xNJw==,type:comment]
|
||||
wpa-psk: ENC[AES256_GCM,data:kn/SkxD2YSHXS8VrskE8GdW5GmCGIxkczoXiInJagcRWuq/xE7JDFRdaT9p/SBRbRESOzCvP7dzbCeoQ7h6Hpg==,iv:qZtAPVzjDCJ8En33c7n3dG0UiQK1VkNHMRtw6VBvtQ0=,tag:B88Vg5oFn8XjhAwUiClaSA==,type:str]
|
||||
sops:
|
||||
lastmodified: "2026-08-12T13:56:49Z"
|
||||
mac: ENC[AES256_GCM,data:MY/ZEi/MzwHPSwTeXsnufRjf3hOs+zDtD8nPTTBbFOh+Xaes64wDI0hgIFn/RwKyMvwI0XIeA4dZ/UWsvZe5CId64JtJ5dxcmB9hUozIdtIT+20bmfhOFG7ww5X/5wimw9BjMjfP/hX+owB5G78LCa8dmNMkHEmybfK4WfwmC8c=,iv:lHO1bn+7mXtbRacj7qoVPIZyOe1BmShXIRFvUWf0MB0=,tag:MyC7ilGZwASppPhQZ2Fl3Q==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-08-12T13:05:39Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA/QlAv6mQqxoARAAm/Q4hyhJ797BpoydN6HcI8olVVXZvp3oQ0WxILt1wH5N
|
||||
7E6JfAEzxzdpEC/2lyS+IORMnLgkhJzlBTv2Wd34mlWeZ08EnhmMpMBHBeUWj6Ah
|
||||
bKJFxfPb2MqcHBm1CLft/ei7mOVnnEb6qzzkXhWFFhxb34e8HCn0oIgREGqpBv6q
|
||||
BQNFYmt9IOQOFvmfnYhppBRL/UyaWENs0veINncmY36ElsFAfb2dpPqJbeEXKnJG
|
||||
+78nUOpctKfKDe16RPHLuiFWKMfzamciPBO0j1YoJo4wh8zoe1l6A0Ar4yFpgpL3
|
||||
4KpNdwZrNjzBH2GTMQ8LdZjnWVcX2V5ZQ3I/srWHSKqFl/Q/pXclSCecV9afZzV1
|
||||
sAvwg1T/WCpJ82LGfJBnYMB2EGhmIAkMCV1tpAacK1MN5rHcuJak3wvRVm7RfEP7
|
||||
n6YoQU7XUkXgsw9rg9tuWt90T3O6Z5PC6f3YtZ4K+yVrA90OKxLhmLxjCnPINikT
|
||||
2rP3biMge5eUplReUtObuxuNr+qVyaKPLPxaW2gBzQ+wjE2O2X2p5McQTGRzh+hi
|
||||
N7foCjniEzQapjV6cjjKwBJS8l+tYxYfuA4yGSJN5O4zc5KgQwP8Lq1ExvYu1hol
|
||||
1XUDjjn46zUzLDvGP7bu/21NOY8e1lKd04fYFUn5czx1MlyrDpmp54zxvKgr+urS
|
||||
XAHQSDnaDhh+2s203YL/j2CSs1oNEbN7ctEaqlvoXhAeGmMAAowFDW9eR3HPtnus
|
||||
65nH3OaXgUIFlARaLYpJl8/pbB06C24qRLah3jaX3dTSFigTv77DyE3ZeUZe
|
||||
=ttg1
|
||||
-----END PGP MESSAGE-----
|
||||
fp: A0C91947734F076F5F08E9FF257D284A2A1D3A32
|
||||
- created_at: "2026-08-12T13:05:39Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hF4Du53yw99JEwQSAQdApGSh5Fbt0y9PGIF6MLk1JkaF4anF9r434ezd9Dj+Gkcw
|
||||
QjMFXhGR/l/QVw1q5Rkwac1FgNpevuWwlupAzmXsD3/yViM+8OwV/+RBCDSSzyUE
|
||||
1GYBCQIQ6gI3gx5E3G1mjLwiSzh6zCxfgpYXeX+desnsgsldj/zkYLnMteTHy7/x
|
||||
/BsURV7CyK6sT/B6okxq1H/lZV3Xr15kvMIc8t44XYkFq+2eyIn5BAOZDLqTZ8Tx
|
||||
EZEc6BiaE7U=
|
||||
=5mFp
|
||||
-----END PGP MESSAGE-----
|
||||
fp: D70ADEB8DFCC7DDB13B83E9B60E9442BA424EBD3
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.12.2
|
||||
48
files/sops/README.md
Normal file
48
files/sops/README.md
Normal file
@ -0,0 +1,48 @@
|
||||
# Guix SOPS -salaisuuksienhallinta
|
||||
|
||||
<https://github.com/fishinthecalculator/sops-guix>
|
||||
|
||||
## Uuden laitteen lisääminen
|
||||
|
||||
Jokaiselle salaisuuksia tarvitsevalle laitteelle luodaan oma PGP-salausavain
|
||||
seuraavan kaltaisella komennolla. Olennaista on, että avaimella ei ole
|
||||
salasanaa eikä se vanhene.
|
||||
|
||||
```
|
||||
gpg --batch --passphrase '' --quick-generate-key \
|
||||
'(SOPS Guix -salauksen purkamiseen) <root@LAITE>' default default never
|
||||
```
|
||||
|
||||
Tämän avaimen yksityinen osa tallennetaan salattuna kaikille ylläpitäjille
|
||||
hakemistoon `host-decryption-keys` käyttämällä apuna `./encrypt-private-key.sh`
|
||||
komentokyhäelmää. Kyhäelmä hakee ylläpitäjien julkiset salausavaimet
|
||||
hakemistosta `./admin-encryption-keys`.
|
||||
|
||||
```
|
||||
gpg --export-secret-keys root@LAITE | ./encrypt-private-key.sh > host-decryption-keys/LAITE.key.gpg
|
||||
```
|
||||
|
||||
Lisäksi yksityinen avain viedään laitteen `root`-käyttäjän avainrenkaaseen.
|
||||
|
||||
```
|
||||
gpg --decrypt < host-decryption-keys/LAITE.key.gpg | ssh root@LAITE 'gpg --import'
|
||||
```
|
||||
|
||||
Avaimen tunniste lisätään salaisuuksienhallinan ohjaustiedostoon `sops.yaml`
|
||||
omalle rivilleen kohtaan `keys`. Tunnisteen saa näkyviin ajamalla komennon
|
||||
`gpg --list-keys root@LAITE`. Kun kaikki ylläolevista on tehty, laitteelle voi
|
||||
asentaa salaisuuksia.
|
||||
|
||||
## Uuden ylläpitäjän lisääminen
|
||||
|
||||
Ylläpitäjä tarvitsee oman PGP-salausavaimensa, jonka voi luoda esimerkiksi
|
||||
GnuPG:llä komennolla `gpg --generate-key`. Avaimen julkinen eli salauspuoli
|
||||
tallennetaan hakemistoon `./admin-encryption-keys` muita ylläpitäjiä varten.
|
||||
|
||||
```
|
||||
gpg --armor --export AVAIN > admin-encryption-keys/YLLÄPITÄJÄ.pub
|
||||
```
|
||||
|
||||
Lisäksi avaimen tunniste pitää lisätä `sops.yaml`-tiedostoon. Jonkun aiemman
|
||||
ylläpitäjän pitää lisätä uusi tiedostojen salausryhmiin ja salata tiedostot
|
||||
uudelleen ennen kuin ne ovat hänen luettavissaan.
|
||||
52
files/sops/admin-encryption-keys/saku-laesvuori.pub
Normal file
52
files/sops/admin-encryption-keys/saku-laesvuori.pub
Normal file
@ -0,0 +1,52 @@
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQINBGCJJvcBEADEsx42OdBcdslRop/VYmEe/KMAEo5zN7mKapZeS8ZeR3dvgxUh
|
||||
3c4uIv8LoWHPbBdnslL8FhSzjxn7L11QOfLwzgdzoMqjVUJJaggvukhkjJXl5mja
|
||||
Yzta5/zmUGVgruHlsqFcJcnICnOgCCZDAVjSw/rTbkd2RN1oVte0b3MCZUv7A3Xi
|
||||
Z6yCrWL0yQikGIQi1CBvdTbca1aUMuhgpyaq1SCUfbe+oq4jc2mvnVsIZucDs48U
|
||||
ofayLDye0GsjOo2vyPRalBq1XhA1hoQYtfdqcENyiMAumfnzJ24ou+YRd2RXPKcc
|
||||
dy9FQrhL7hLwp+bewPXbrObgCiV2NyussShFe/m6C0A6RFBLSfG+dTFt4F/joWei
|
||||
yJmjt6FIRpHvTEjluvpn3ApO4JmlxBlTIUBcgJJp/UQ+IUSYEOAdoOw9RGn1sNG8
|
||||
uN++AvQXZZyFCMFrd1amJd6rjqVvIyc7DGyilmBF7os2p/iss+sQWdlAKuZQU6Zv
|
||||
xFR3Ltl+qhYNATSuKh9z7VdSiBLCJEHam4htdduwRroh5gXjQjAaLNPDihBLV46Q
|
||||
Oz3iI6gZbF3+QQy03hqXXc9W98tfd/nXgepD2S8SZPCmY3SY7JI9E98HGH7JiHeg
|
||||
cpOfK9Knn5NGfH92PyOjRnowvsNHLsR1VsmlNovk5wkNfRRPg5TBRDXcMQARAQAB
|
||||
tCJTYWt1IExhZXN2dW9yaSA8c2FrdUBsYWVzdnVvcmkuZmk+iQJXBBMBCgBBAhsD
|
||||
BQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAhkBFiEEoMkZR3NPB29fCOn/JX0oSiod
|
||||
OjIFAmlX1uAFCQqv42kACgkQJX0oSiodOjK0Gw/9EktRq8Uip53fzMr8MeTm/qcm
|
||||
aO8/dlYIAF4i+QjGWrHTv6PfP8lFLEm/Q+AktvjKhvOzIJA1tGKHGZWnQMLwDNx2
|
||||
uEBaStoHI9sXFH73Sqb/sopcbY9z7tV6fRHxMYwAnCgwjgxT4C6Q/gs9EG2z7Jjg
|
||||
TXUklHXjKavnviLDP+G4M4ce3JlHR/RhAtX6M23mmvRSGBdDBsJ1kC8ot1xSnJNo
|
||||
Xo6LSpA994OJyQ5c7EFqSsBU0E2Vp/7hgT2vBufZg9oVsEjmPBrLHPcEPt6qu3lr
|
||||
mNjDgDWM6poopelqnn3+GTNaLGi20JDz/8S+X+X0v4YLevSFgBseATtB0nFngQ4X
|
||||
nnkRvfVZWMQUUF7K8RCbtfLREy84WfEhPy7hVzbyuYhynTpvD3chCLoyWjXPV70X
|
||||
BggdKDJLeVUBFXk2kZ+qQiwFeSv++/FSgIQgwRJiVB0eVNLPCdcWXr5kcel2gbEe
|
||||
C17T/z6DJiXMjrrht3vdm+g7K0jAk7UaIr/oBxEYPkJoru1N811YAk0Rys1+cHqe
|
||||
6swARZrdpYaBY831XJ77nuVjAqBR0JGKaW1UaPsK0ykzbIa30SNaIqt0cFBDjqbG
|
||||
ia3LQ/is1UqRyiJXdS47/WBGKt6mAj+OhW7fnl1Ps2YglGh+4ZehvpRdEVBG6pM/
|
||||
ciOkn08eT+cOey8KpxS5Ag0EYIkm9wEQAL3qGd774FTzLFqjJICQWYisCBst07Tf
|
||||
4aVKRJEQZkKnWNOQzQltSa5nHRLVtdEvvbejK+Ci8/l2yI58PkqkbKlL9K/IRgHn
|
||||
8xqxWVcirbDZq32g5SI0zSa1B296o12TJrKGBSGBcAI0NRUaSUJmGy4HvIGdf8oV
|
||||
xqvNDKL4I2igf5Kj3mMOZzFjbOr17SUetF72W1w5BAqLWX32YVXnC/RHP7WRuFv7
|
||||
LLpsAHOgnInQ44BF8WQdxnliJr18Pz/kyW/otMsVq4OxNMwYTiRDqBmDNPZmLHTd
|
||||
thXvb41pI95Opk/th/8xc3+w1wAfcrx/vRccvfgr0nN4q4mqKAZSp4qJQocGF8xf
|
||||
JGc0CurTdQwQT2yWEmoVIqoQLTJOhX8NuC9JI/U8b2riRMcAVU37pzHWxUepsbH/
|
||||
rEVYbVSaSRLVKTNCOmDSvOtQ7LZBHvAoVGG7Zzoluqg0X2GqrdCyCaBdFBgWOlw8
|
||||
/2q+dR6JxMXcmSDxAJuZgI2oR4bTSXPbQT5ezqSq/71g2+CKw5me4KEOoZiuAVOS
|
||||
vMv05wU3/s3yJpCYK5OMsBgRaSWE7+QIQjr4+467/Bxo3mP5eIgKA6M67qT89TIK
|
||||
VSALA14mCnc991fW67ib9Y4Sx9ZtHvaYL5i6tZ143ShTfsfifpyoZt0LhA8CL3Ac
|
||||
W6wpqdgcIoWPABEBAAGJAjwEGAEKACYCGwwWIQSgyRlHc08Hb18I6f8lfShKKh06
|
||||
MgUCaVfbzwUJCq/oWAAKCRAlfShKKh06MjjPEACjw1+ZuXLpQYj4ZSkpq6iL2LoJ
|
||||
AyxmxHUKeZDGMhyyf+Tt06l+cY2Gj2fGfSlRawDbfaoVoVV3crH0dzwUh3FeIfMM
|
||||
6Xj1h1hsUJhFxKkaLSd1jfyf3ycuJ/XoxACt+gVEW6/EkOQMRI6gAjPJDYmh2a5K
|
||||
WmArWJXzUk0RIQ147qbi0EdcI5FUIUj1hGvrwjXhfsbdbwH8gm1fQ/6iKr9EilLS
|
||||
pmmAmaTMtmz0GfUi95ksV1tQF8wTogDcUE2LHCfZLz9fXqh3JKkdl5uXcrJYjFRk
|
||||
A16/1aiL5RhEaNcIj6luiuhRZ1wLGdW2eSw0yeCIkxgwY1/C8oJze2V4Gybywcof
|
||||
cZNs4gDFxqCM65H+17f8oTIeuQ0Wuphxde2F7Gy8M2/RBSm9750Mx8sx4qyjUqXb
|
||||
OIMM1NeuRlY2pehHbhgPTiVFfDkFrY8mYLAMeW5txUrfs/m+ocu0sDau/rInX6uP
|
||||
mezxbJ5z182OLIkDLB1XaN/ThZbJbsB4TjXNrXjk40UgwLEwJ07jA2uZcgRCpwzJ
|
||||
OEvEr9u56z0fQCAlQTfTNCbndzZXBygtayg2CfhDg7gI/d/nLm2xqx6ZaFVGQEz1
|
||||
kiuzcsLPmeu7zI9ehSui6o7g77q2e2sq96OVvTzX3m0Iyqip+Y3If7pT3CZBvsXe
|
||||
8WXUYb+YeXxijAcFcQ==
|
||||
=AmUD
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
9
files/sops/encrypt-private-key.sh
Executable file
9
files/sops/encrypt-private-key.sh
Executable file
@ -0,0 +1,9 @@
|
||||
#!/usr/bin/env sh
|
||||
|
||||
recipients=""
|
||||
|
||||
for key in admin-encryption-keys/*; do
|
||||
recipients="--recipient-file $key $recipients";
|
||||
done
|
||||
|
||||
gpg --encrypt --armor $recipients "$@"
|
||||
40
files/sops/host-decryption-keys/OMS-kone.key.gpg
Normal file
40
files/sops/host-decryption-keys/OMS-kone.key.gpg
Normal file
@ -0,0 +1,40 @@
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA/QlAv6mQqxoAQ/+IxiRZ13lM9CT7lwB9Ewpge+C1BPls9oKbsP0SGljHioQ
|
||||
zDV87YewbECrDuw6MzYxBtig5vbNMfpy9y78f34U4R7ICQ450SpqpCzz6V1C6mVb
|
||||
aZxz16IvS1cniQkqY0NFXczuiLteGCFn6Q3S9s35OWWk/PCVibs4npTI+zKGOvw9
|
||||
BoQbn8eo5y4zdcxhFvYZzzkypNjxHY+++HcyXesNvMgTzcNDnwjkzyFGxcsN9CtC
|
||||
0HIy7sfxXy9hIWj9KHf9gIdZKRaH+1/7W90h+UimJcvDuyEe9+t7VkQHY8l5aihf
|
||||
5TOgeE+Lr3WgaiZnYUPbyUn66bzgSk9gpr04TpnTTj2txo1Unvb8TbKmqjT5xHP2
|
||||
ds/tVw3sBdRjMHS0LSpD+gJmn97ZIKfSmSPGfXnvKU/frLF/oIm9tUnU1W1fDNX4
|
||||
eBNZUwicXL8JSrjjKEYlUwUjqpnezUuns2WH6Tm3npa+rGS9gVcf1fYq8YCgcBvB
|
||||
i4LEMFFCTrHrMI/VkG8H7nLG69olf9gjglrKjC+ddpzDarC1iZVX0g/hJRGaoql6
|
||||
iIqtNRPAYv4iV484t4xyzMVGra5RIFhYS9wknbgVyPkB9AuDBfttuV/8hSv08m5s
|
||||
5WjTY4zULV2KPPL3mLVBat5B/MPkOwkifMlYqgULx7nWe/6c+7NGRb6V/fsQB6nS
|
||||
6gH4DduuI5fX7LIcx8sLjEB3nQju5BquYehjf9WGUOD2WuvdPJxyfmsZ5Rd9ky7H
|
||||
fjhvHuoDybqMyjb/e8DAyhVWmVQpJfWQnZIXua5I55sr1cq2KhQzG/1SgKiGGam+
|
||||
yHXksNNyy/koUOmUhByKu9eozUj8+TJfJzi0hHN7kTARntiLaBeAeilqQpCocdCR
|
||||
/VQFKfHEKSGaYt28SsAXCri59zzS4deq5Yp/NuNEFCDyr2oYiX4gjcHUH2dqU9py
|
||||
msFBSj3eaXMB3rFTOwDpW9Umo/3+ji3D4zMFmBDOV4G0qEDCKO9rHVGwgevojrO6
|
||||
DNU5hVj/xh6DNCewQ/fbQKAcbGdvJCN7eZIlEs0Kq9JJQL/R8Qa6C2PD9VrQ/Ezn
|
||||
K+8umVe/+DSDDMvdv3KmVd2y/u8yRLc6Jcx1AyAMQg59PeBkYC5qWl+/mzTPediy
|
||||
Eq1CaM/ojcqYR0RS+kANJMxXSWaxecPt0hVGFtHa4Ra2464fcolZX2STr04ZYV17
|
||||
G3O7vuDEVWFZ35cjH7i+vtqK4XxdDkqq8CuXhbBjov3i1IDcUu9j8UJMRhzvqS7N
|
||||
OQWqK7rejLy7Yg5dQBDUokOHWWTXsO3WjwNHN4FQZ1BY8Uy3UDXoJX+69N00XAIp
|
||||
gplViNc5qDT2UCgCUGDN3viCtF/u3oSz87HgD+TgGEAWtabjxoHxhmzDea6HyzB+
|
||||
QGJuGVR1Jbbl+CAHBIa897ej3dRz25NBNFlYPwbHf6BNQq9gZZ35Vw+3LMMgS1a0
|
||||
tEaWKRzlkdFo2kH1Im+8s4l6Wj9KDOqSu+djpzwtayorI9Bi3tlfe5K8uGWFCH7C
|
||||
HjHXApdFG4Y/faJEYPl866396K32XqbGBWG/43VO+XZLYrQvp4fKuuruGlpqDZHc
|
||||
pW1eSkBiBYiu2apn+GeJwnczH7ZNZKdU3XiS2niAH2onXgjHxSbfknSm7HqqkHdh
|
||||
yph03teQn+hJSF96hXwgcJoBTQ6OZiqzliXEj1pDlcHJAQa11K8Vd1iBzgJwD/n0
|
||||
eQDtz0AQTobmBLs84DZgT/+q8GOFhNjwwuaY1iOP7fyJ6fgthxDVUv5p2ea/UTnb
|
||||
8e00d1oh8DAbJgJOVEOkqabdZH9l0m+Mh8As3Z7ISVJ/FXInGTM5nR7VRwq3tRUd
|
||||
9lT5ECD73ojmYEr8TLkvsmtCknLMn+H1B09kI2wrgBIgTojOt5A2a4XAO3OGhQ3O
|
||||
75FbzelKvRzLwf5wULkoMXZEKJ8NLiEG9WJKrcetY4s9NTgJl81GOBpo9NrRXtxZ
|
||||
H9xBKXngaMQEWKQXcuoIKzOQCQcLPE9fitMWHSVGe9DcJK4H6nJKZtotNh1B1CtE
|
||||
czmmlbyiMenZp65kQ1Bo3OWTXUBLcKAP7fEkuNfgOFOTC/cbRgT/KMyCk2QZpeO3
|
||||
TvF8Va3DwIfAda1JNvBqimJLZxOvH2SP2sHBer2N5M50xb8filhy3GflbNFaCBmv
|
||||
FUH6OLFWpWbanoEDx57vWkTZlTN2IvtV3WlOEAweFbmaO4LzOWH3zFJ8zOkzenr/
|
||||
PMDALdN2jfmnxE/zJvYD82TbanNy
|
||||
=PuIl
|
||||
-----END PGP MESSAGE-----
|
||||
1
manifest.scm
Normal file
1
manifest.scm
Normal file
@ -0,0 +1 @@
|
||||
(specifications->manifest (list "sops" "wpa-supplicant"))
|
||||
@ -5,13 +5,19 @@
|
||||
#:use-module (gnu services base)
|
||||
#:use-module (gnu services cups)
|
||||
#:use-module (gnu services desktop)
|
||||
#:use-module (gnu services dns)
|
||||
#:use-module (gnu services guix)
|
||||
#:use-module (gnu services networking)
|
||||
#:use-module (gnu services ssh)
|
||||
#:use-module (gnu services sysctl)
|
||||
#:use-module (gnu services vpn)
|
||||
#:use-module (gnu services xorg)
|
||||
#:use-module (guix gexp)
|
||||
#:use-module (nongnu packages linux)
|
||||
#:use-module (nongnu system linux-initrd)
|
||||
#:use-module (oms channel-file)
|
||||
#:use-module (sops secrets)
|
||||
#:use-module (sops services sops)
|
||||
#:export (base-operating-system))
|
||||
|
||||
(define* (base-operating-system host-name #:key (firmware (list linux-firmware)))
|
||||
@ -130,3 +136,75 @@ ID with the extended system as it's value."
|
||||
(inherit base)
|
||||
(initrd-modules
|
||||
(append '("vmd") (operating-system-initrd-modules base))))))
|
||||
|
||||
(define-system oms-kone
|
||||
(let ((base (base-operating-system "OMS-kone"
|
||||
#:firmware (list ibt-hw-firmware iwlwifi-firmware)))
|
||||
(wpa-psk (sops-secret
|
||||
(key '("wpa-psk"))
|
||||
(file (channel-file "sops/OMS-kone.yaml")))))
|
||||
(operating-system
|
||||
(inherit base)
|
||||
(kernel-arguments %default-kernel-arguments)
|
||||
(swap-devices '())
|
||||
(services
|
||||
(append
|
||||
(list (service dhcpcd-service-type
|
||||
(dhcpcd-configuration
|
||||
(interfaces '("enp1s0"))))
|
||||
(service dhcpd-service-type
|
||||
(dhcpd-configuration
|
||||
(interfaces '("wlp2s0"))
|
||||
(config-file (channel-file "OMS-kone/dhcpd.conf"))))
|
||||
(service dnsmasq-service-type
|
||||
(dnsmasq-configuration
|
||||
(listen-addresses '("192.168.1.1"))))
|
||||
(service hostapd-service-type
|
||||
(hostapd-configuration
|
||||
(interface "wlp2s0")
|
||||
(ssid "Samoojaverkko") ; muokatessa päivitä wpa_psk
|
||||
(channel 1)
|
||||
(extra-settings
|
||||
(string-append "wpa=2\n" "wpa_psk_file="
|
||||
(sops-secret->secret-file wpa-psk)))))
|
||||
(service nftables-service-type
|
||||
(nftables-configuration
|
||||
(ruleset (channel-file "OMS-kone/nftables.rules"))))
|
||||
(service sops-secrets-service-type
|
||||
(sops-service-configuration
|
||||
(secrets (list wpa-psk))))
|
||||
(service static-networking-service-type
|
||||
(list (static-networking
|
||||
(provision '(wifi-ip))
|
||||
(addresses (list (network-address
|
||||
(device "wlp2s0")
|
||||
(value "192.168.1.1/24")))))))
|
||||
(service wireguard-service-type
|
||||
(wireguard-configuration
|
||||
(peers
|
||||
(list
|
||||
(wireguard-peer
|
||||
(name "olarinmaensamoojat.fi")
|
||||
(endpoint "olarinmaensamoojat.fi:51820")
|
||||
(public-key "UT4RGKMzp61DYiiodsrvHc6m/tkSqLNo2wqxwACrdl4=")
|
||||
(allowed-ips '("192.168.3.3/32"))
|
||||
(keep-alive 25))))
|
||||
(addresses '("192.168.3.2/24"))
|
||||
(private-key "/etc/wireguard/oms-kone.key")
|
||||
(shepherd-requirement '(networking)))))
|
||||
(modify-services (operating-system-user-services base)
|
||||
(elogind-service-type config =>
|
||||
(elogind-configuration
|
||||
(inherit config)
|
||||
(handle-power-key 'ignore)))
|
||||
(sysctl-service-type config =>
|
||||
(sysctl-configuration
|
||||
(inherit config)
|
||||
(settings (cons '("net.ipv4.ip_forward" . "1")
|
||||
%default-sysctl-settings))))
|
||||
(gdm-service-type config =>
|
||||
(gdm-configuration
|
||||
(inherit config)
|
||||
(auto-suspend? #f)))
|
||||
(delete network-manager-service-type)
|
||||
(delete wpa-supplicant-service-type)))))))
|
||||
|
||||
Loading…
Reference in New Issue
Block a user