diff --git a/nixos/boxes/kelder/containers/acquisition/networking.nix b/nixos/boxes/kelder/containers/acquisition/networking.nix index 00bc264..0f5afc7 100644 --- a/nixos/boxes/kelder/containers/acquisition/networking.nix +++ b/nixos/boxes/kelder/containers/acquisition/networking.nix @@ -4,22 +4,29 @@ let inherit (lib.my) networkdAssignment; wg = { - keyFile = "kelder/acquisition/mullvad-privkey"; + keyFile = "kelder/acquisition/airvpn-privkey"; + pskFile = "kelder/acquisition/airvpn-psk"; fwMark = 42; routeTable = 51820; }; - # Forwarded in Mullvad config - transmissionPeerPort = 56630; + # Forwarded in AirVPN config + transmissionPeerPort = 26180; in { config = mkMerge [ { my = { secrets = { - files."${wg.keyFile}" = { - group = "systemd-network"; - mode = "440"; + files = { + "${wg.keyFile}" = { + group = "systemd-network"; + mode = "440"; + }; + "${wg.pskFile}" = { + group = "systemd-network"; + mode = "440"; + }; }; }; @@ -56,6 +63,8 @@ in netdevConfig = { Name = "vpn"; Kind = "wireguard"; + # Specified by AirVPN + MTUBytes = "1320"; }; wireguardConfig = { PrivateKeyFile = config.age.secrets."${keyFile}".path; @@ -64,10 +73,11 @@ in }; wireguardPeers = [ { - # mlvd-ie-dub-wg-101 + # AirVPN IE wireguardPeerConfig = { - Endpoint = "146.70.189.2:51820"; - PublicKey = "lHrukA9+vn7Jjzx2Nb/1NQ0WiaiKppEqVxrGT5X1RFQ="; + Endpoint = "146.70.94.2:1637"; + PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk="; + PresharedKeyFile = config.age.secrets."${pskFile}".path; AllowedIPs = [ "0.0.0.0/0" "::/0" ]; }; } @@ -83,8 +93,8 @@ in ]; "90-vpn" = with wg; { matchConfig.Name = "vpn"; - address = [ "10.66.242.99/32" "fc00:bbbb:bbbb:bb01::3:f262/128" ]; - dns = [ "10.64.0.1" ]; + address = [ "10.161.170.28/32" "fd7d:76ee:e68f:a993:b12d:6d15:c80a:9516/128" ]; + dns = [ "10.128.0.1" "fd7d:76ee:e68f:a993::1" ]; routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [ { Family = "both"; diff --git a/secrets/kelder/acquisition/airvpn-privkey.age b/secrets/kelder/acquisition/airvpn-privkey.age new file mode 100644 index 0000000..60233fe --- /dev/null +++ b/secrets/kelder/acquisition/airvpn-privkey.age @@ -0,0 +1,13 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSB4NWhG +VTZNTFEyQ3oybkZqSUxGenBwdDBmVHNMTmlXMEZ3b2ZiKzdhUDI4ClhNMzAyNHdx +YnZhRlRwUVpkMHRJMkxVeFJ4MGwxamRjNW0ySzVjc2thdWMKLT4gWDI1NTE5IHk2 +dng5VEM2amRpMThlREk0dy9QTlRKRVIvVkN2YWx0SG54UWp4R0hFejQKanRlYmxP +NVVtYXJxdVFsdzJhM2lvU09kWElmS1psM3VYQzhrMkpZK3RKcwotPiBsOy1ncmVh +c2UgRDNvSiFGIHVjK19PMSwsIGwKbDM4UE5HNkl1c0tQM0JHOG1EaWRFNUZhYlg5 +NE5PSTl3K1NQRW5VeWYzNVV0OXd1TmpRK21sbzN5VUZHYzZhWgpVemJMTE80M2p0 +NmM1SjQ0UCtHa1ArbVhkWis2NTc1YmJHcGN1eURFWkFxbWhHdEJvSkFBCi0tLSA0 +N29PNTlYOUpza0FxNmpKRTUwNTJWSGNtMUI1Y2dVQW5xeWFVZFdHMmFNCvME06Jn +IcrlscKEzgADVR4uS9C8WQrcclw6EO3abNqKrYYcjG8zm0HgoxXY3D5VIsSjISGP +lR5AfhtwYJlTk2mbpESqa+Dgn6M4jodm +-----END AGE ENCRYPTED FILE----- diff --git a/secrets/kelder/acquisition/airvpn-psk.age b/secrets/kelder/acquisition/airvpn-psk.age new file mode 100644 index 0000000..bbbe1a6 --- /dev/null +++ b/secrets/kelder/acquisition/airvpn-psk.age @@ -0,0 +1,12 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSA1eURm +TXYyV01IT3c5QXlVdjVvTThNM08zblR1UFZmUUNGWVVsT3Z0bG1rCityR3k4TzZT +M3FnNVRGL2wxZk9NTXc4NkNpR3VQN242ZGJ6cC9CUmpqNTQKLT4gWDI1NTE5IFRL +YnRHVzJ3V05jZUQycFR5L0VTa0RBd1p4T1pDa2ZoSnUxRGEramdWR2MKam5Obktp +M2NzbDVoclYxQ3o1RCswUHB3N0lMY0hQdFJKVytaUCsyeGZQYwotPiAuLWdyZWFz +ZSB5enkmCmFneG5tL1VxZTZvT1BJOC9pYVZ5MGxZTm9MR0pLanBpTnpwYmU0Nzkr +MGc0aFltRlBobHlIcStFd2lrZk1XS1AKNDFMNzBYalZSUGNKRG1NSkpaRDRBSk5J +bm1wVnBBCi0tLSBCS3E5UmJ1ZWFFUkRaRk1uK3FTaHhObkFXOXRjNWVnZFU4Z1hv +TU1tWGc0CiGhLA73FZyq1kFPjq0PLL2v7u2DtdjJT9Brxzn4lNPTdMYVOMtPbMzX +eWSF1QvmZ6VUbUwKnqVd34lrenUffGnqCxWfp9gk1rxB2/SS +-----END AGE ENCRYPTED FILE----- diff --git a/secrets/kelder/acquisition/mullvad-privkey.age b/secrets/kelder/acquisition/mullvad-privkey.age deleted file mode 100644 index f0037ff..0000000 --- a/secrets/kelder/acquisition/mullvad-privkey.age +++ /dev/null @@ -1,13 +0,0 @@ ------BEGIN AGE ENCRYPTED FILE----- -YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDdXUTlQQSB6ZEFn -Rk45WFh1S2NDWmdNTW1aWGJVdTY4aGowQlhpYUFBdUNmc29od0hnCjI2cVlDVVd5 -VXJKRU90ME9SeFNwRXd4WmM0d0FUVVJLeE1uVEhpalBZVUkKLT4gWDI1NTE5IEoz -MHJhNFhBMEhmdFhnWUtrSjFaaDFGbStWdlBneHFZQ0xKSUNabk50akkKb0h4dzB0 -Z2lxSWZTMmFQbkFrUTZtdE1XZzJmRGZjMDl5bURDeUtQUEFTdwotPiAlWT5hI2wt -Z3JlYXNlCmxYVnpVS0x2Y3FWYW5DbW05eVM1SWxkMUxXalRGdFdGM2NRVkRoWGVl -Y0hyOGhJbnBTY2ZsdzRKbXJaU3M5SnEKZjhCTXRiRkJqelBYMHRFSlNoUGRMQzJ0 -NjNlTlRmUi9qdDMzdWlCSkM5ZWF1dXc4cncKLS0tIDJ1cUREVWszcHlhMThMSTY1 -ZDYzbmtsemxhcE1OM2ZPeG5jZXdKeEgwQVUKNVCcrmBW19BH8MX8k1tqSv0RO796 -H1Rh+7gzNw/Oczl6jcqmBeqTqgW+GGDN0B5FMO9L9Gf9DzSyHL/oyK7Sd5ECdbGY -mTmbYKo7C1k= ------END AGE ENCRYPTED FILE-----