Torjus Håkestad
0700033c0a
Replace sops-nix secrets with OpenBao vault secrets across all hosts. Hardcode root password hash, add extractKey option to vault-secrets module, update Terraform with secrets/policies for all hosts, and create AppRole provisioning playbook. Hosts migrated: ha1, monitoring01, ns1, ns2, http-proxy, nix-cache01 Wave 1 hosts (nats1, jelly01, pgdb1) get AppRole policies only. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
41 lines
966 B
Nix
41 lines
966 B
Nix
{ config, ... }:
|
|
{
|
|
vault.secrets.wireguard = {
|
|
secretPath = "hosts/http-proxy/wireguard";
|
|
extractKey = "private_key";
|
|
outputDir = "/run/secrets/wireguard_private_key";
|
|
services = [ "wireguard-wg0" ];
|
|
};
|
|
|
|
networking.wireguard = {
|
|
enable = true;
|
|
useNetworkd = true;
|
|
|
|
interfaces = {
|
|
wg0 = {
|
|
ips = [ "10.69.222.3/24" ];
|
|
mtu = 1384;
|
|
listenPort = 51820;
|
|
privateKeyFile = "/run/secrets/wireguard_private_key";
|
|
peers = [
|
|
{
|
|
name = "docker2.t-juice.club";
|
|
endpoint = "docker2.t-juice.club:51820";
|
|
publicKey = "32Rb13wExcy8uI92JTnFdiOfkv0mlQ6f181WA741DHs=";
|
|
allowedIPs = [ "10.69.222.0/24" ];
|
|
persistentKeepalive = 25;
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
homelab.monitoring.scrapeTargets = [{
|
|
job_name = "wireguard";
|
|
port = 9586;
|
|
}];
|
|
|
|
services.prometheus.exporters.wireguard = {
|
|
enable = true;
|
|
};
|
|
}
|