move sigma-{public,p2p} to sigma

flake.lock

@@ -165,11 +165,11 @@
     },
     "secrets": {
       "locked": {
-        "lastModified": 1711641020,
-        "narHash": "sha256-und6yndmaPsS/wEkqrEvN02VbK+HCFz0zglRNaZeCJI=",
+        "lastModified": 1711740735,
+        "narHash": "sha256-/NmklXfLak65luQoMsUl539faoabD+lo7P9fNDaXkic=",
         "ref": "refs/heads/master",
-        "rev": "057f8a2b8cd29a70764004d035a6a9e33c73f4ff",
-        "revCount": 5,
+        "rev": "42e5e76765daf6dd36fa195a5a424d8d69c15dfa",
+        "revCount": 6,
         "type": "git",
         "url": "ssh://git@git.caspervk.net/caspervk/nixos-secrets.git"
       },

hosts/alpha/network.nix

@@ -45,9 +45,9 @@
       name = "wg-sigma-public";
     };
 
-    # The following routes traffic destined for 116.203.6.156 (floating IP) to
-    # sigma through wireguard. This allows the server to have a public address
-    # and help others sail the high seas even though it is behind NAT.
+    # The following routes traffic destined for the sigma-p2p address (floating
+    # IP) to sigma through wireguard. This allows the server to have a public
+    # address and help others sail the high seas even though it is behind NAT.
     netdevs."51-wg-sigma-p2p" = {
       netdevConfig = {
         Name = "wg-sigma-p2p";
@@ -62,7 +62,7 @@
           wireguardPeerConfig = {
             PublicKey = "sigmaH/DKSU8KWyrPtucYmS2ewUvDvCNLxd/qYEo0n0=";
             PresharedKeyFile = config.age.secrets.wireguard-preshared-key-file.path;
-            AllowedIPs = ["116.203.6.156/32"];
+            AllowedIPs = ["${secrets.alpha.sigma-p2p-ip-address}/32"];
             RouteTable = "main";
           };
         }

hosts/omega/default.nix

@@ -7,7 +7,6 @@
     ../../modules/syncthing.nix
     ./hardware.nix
     ./borg.nix
-    ./network.nix
     ./sway.nix
   ];
 

hosts/sigma/default.nix

@@ -5,7 +5,7 @@
     ../../modules/server
     ./hardware.nix
     #./borg.nix
-    #./network.nix
+    ./network.nix
   ];
 
   networking.hostName = "sigma";

hosts/sigma/hardware.nix

@@ -10,7 +10,7 @@
     (modulesPath + "/installer/scan/not-detected.nix")
     nixos-hardware.nixosModules.common-cpu-amd
     nixos-hardware.nixosModules.common-cpu-amd-pstate
-    #nixos-hardware.nixosModules.common-gpu-amd
+    nixos-hardware.nixosModules.common-gpu-nvidia
     nixos-hardware.nixosModules.common-pc
     nixos-hardware.nixosModules.common-pc-ssd
   ];

hosts/sigma/network.nix

@@ -6,8 +6,8 @@
   systemd.network = {
     config = {
       routeTables = {
-        "wg-sigma-public" = 822944075;
-        "wg-sigma-p2p" = 2553;
+        "wg-sigma-public" = 42;
+        "wg-sigma-p2p" = 6881;
       };
     };
 
@@ -20,7 +20,7 @@
         Kind = "wireguard";
       };
       wireguardConfig = {
-        PrivateKeyFile = config.age.secrets.wireguard-private-key-file-omega.path;
+        PrivateKeyFile = config.age.secrets.wireguard-private-key-file-sigma.path;
       };
       wireguardPeers = [
         {
@@ -59,16 +59,16 @@
     };
 
     # The following establishes a wireguard tunnel to alpha and configures
-    # receiving traffic destined for 116.203.6.156. This allows the server to
-    # have a public address and help others sail the high seas even though it
-    # is behind NAT.
+    # receiving traffic destined for the sigma-p2p address. This allows the
+    # server to have a public address and help others sail the high seas even
+    # though it is behind NAT.
     netdevs."51-wg-sigma-p2p" = {
       netdevConfig = {
         Name = "wg-sigma-p2p";
         Kind = "wireguard";
       };
       wireguardConfig = {
-        PrivateKeyFile = config.age.secrets.wireguard-private-key-file-omega.path;
+        PrivateKeyFile = config.age.secrets.wireguard-private-key-file-sigma.path;
       };
       wireguardPeers = [
         {
@@ -85,11 +85,11 @@
     };
     networks."wg-sigma-p2p" = {
       name = "wg-sigma-p2p";
-      address = ["116.203.6.156/32"];
+      address = ["${secrets.sigma-p2p-ip-address}/32"];
       routingPolicyRules = [
         {
           routingPolicyRuleConfig = {
-            From = "116.203.6.156/32";
+            From = "${secrets.sigma-p2p-ip-address}/32";
             Table = "wg-sigma-p2p";
           };
         }
@@ -104,8 +104,8 @@
     group = "systemd-network";
   };
 
-  age.secrets.wireguard-private-key-file-omega = {
-    file = "${secrets}/secrets/wireguard-private-key-file-omega.age";
+  age.secrets.wireguard-private-key-file-sigma = {
+    file = "${secrets}/secrets/wireguard-private-key-file-sigma.age";
     mode = "640";
     owner = "root";
     group = "systemd-network";