Compare commits
33
Commits
4bafc64b84
...
7d549a9c17
| Author | SHA1 | Date | |
|---|---|---|---|
 Berwn
|
7d549a9c17 | ||
|
Berwn
|
ac60d527ae | ||
|
Berwn
|
3471faa466 | ||
|
Berwn
|
db22afc6e3 | ||
|
Berwn
|
04d3518c03 | ||
|
Berwn
|
94daf06814 | ||
|
Berwn
|
3093ed7044 | ||
|
Berwn
|
c1fad33ad7 | ||
|
Berwn
|
60f6884f35 | ||
|
Berwn
|
d2b352543b | ||
|
Berwn
|
7639d477c8 | ||
|
Berwn
|
8327e4997a | ||
|
Berwn
|
060091247a | ||
|
Berwn
|
9ccfbc3959 | ||
|
Berwn
|
4585fe7b7f | ||
|
Berwn
|
89eb50fcd7 | ||
|
Berwn
|
430c9996ae | ||
|
Berwn
|
158252323f | ||
|
Berwn
|
a87b579eb7 | ||
|
Berwn
|
7cd44d957c | ||
|
Berwn
|
dc2183a83a | ||
|
Berwn
|
b0aa12ac07 | ||
|
Berwn
|
745b82a4ee | ||
|
Berwn
|
88bbba0eae | ||
|
Berwn
|
3f9559766f | ||
|
Berwn
|
d53a1e6524 | ||
|
Berwn
|
b7317ea4ff | ||
|
Berwn
|
832dcb1af9 | ||
|
Berwn
|
41a2d22be0 | ||
|
Berwn
|
2fbdd8e2c0 | ||
|
Berwn
|
62b0b81d19 | ||
|
Berwn
|
4fa491fd63 | ||
|
Berwn
|
b8622b3e93 |
@@ -1,30 +1,54 @@
|
||||
let
|
||||
hosts = import ./modules/hosts.nix;
|
||||
|
||||
# Single source of the machine list: inventory AND the per-machine baseline
|
||||
# below are both derived from it, so no machine can be added without the
|
||||
# baseline (e.g. admins group encryption for all its generated secrets).
|
||||
fleet = {
|
||||
control = { };
|
||||
ns1 = { };
|
||||
ns2 = { };
|
||||
mx1 = { };
|
||||
web01 = { };
|
||||
# Site gateways (Topton 1U routers): dynamic PPPoE WAN, so they are NOT in
|
||||
# modules/hosts.nix / the `internet` instance — clan reaches them over the
|
||||
# zerotier mesh (or Tor) instead.
|
||||
gw-cnx-1 = { };
|
||||
};
|
||||
in
|
||||
{
|
||||
# Ensure this is unique among all clans you want to use.
|
||||
meta.name = "cnx-network-clan";
|
||||
meta.domain = "cnx-network.internal";
|
||||
|
||||
inventory.machines = {
|
||||
control = { };
|
||||
ns1 = { };
|
||||
ns2 = { };
|
||||
mx1 = { };
|
||||
web01 = { };
|
||||
};
|
||||
inventory.machines = fleet;
|
||||
|
||||
inventory.instances = {
|
||||
|
||||
admin = {
|
||||
roles.default.tags.all = { };
|
||||
roles.default.settings.allowedKeys = {
|
||||
# Admin SSH keys + root password, split per the clan-core migration off
|
||||
# the deprecated `admin` service (sshd handles keys, users the password).
|
||||
sshd = {
|
||||
roles.server.tags.all = { };
|
||||
roles.server.settings.authorizedKeys = {
|
||||
"berwn" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIENAjhGQGraQoAjJzsomKP8GAmQPeGL1rNRNHgRcLqtT";
|
||||
"kurogeek" =
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek";
|
||||
};
|
||||
};
|
||||
|
||||
root-user = {
|
||||
module = {
|
||||
name = "users";
|
||||
input = "clan-core";
|
||||
};
|
||||
roles.default.tags.all = { };
|
||||
roles.default.settings = {
|
||||
user = "root";
|
||||
prompt = false; # auto-generate, like the old admin service
|
||||
share = false; # per-machine password, not fleet-wide
|
||||
};
|
||||
};
|
||||
|
||||
zerotier = {
|
||||
roles.controller.machines."control" = { };
|
||||
roles.peer.tags.all = { };
|
||||
@@ -65,6 +89,11 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
machines = {
|
||||
};
|
||||
# Fleet-wide baseline applied to every machine. Secrets minted by
|
||||
# `clan vars generate` are encrypted for the admins group from the very
|
||||
# first run — generating before this took effect is what forced the
|
||||
# re-encryption dance (`clan vars fix`) on gw-cnx-1.
|
||||
machines = builtins.mapAttrs (_: _: {
|
||||
clan.core.sops.defaultGroups = [ "admins" ];
|
||||
}) fleet;
|
||||
}
|
||||
|
||||
@@ -3,5 +3,7 @@
|
||||
- [Overview](./overview.md)
|
||||
- [ZeroTier mesh](./mesh.md)
|
||||
- [DNS](./dns.md)
|
||||
- [Mail](./mail.md)
|
||||
- [Site gateways](./gateways.md)
|
||||
- [Monitoring](./monitoring.md)
|
||||
- [Backups](./backups.md)
|
||||
|
||||
@@ -0,0 +1,100 @@
|
||||
# Site gateways
|
||||
|
||||
NixOS routers (OPNsense replacements) on Topton 1U fanless boxes — Intel N300,
|
||||
4x i226-V 2.5G ports (some units add 2x 10G SFP+), 16GB DDR5, 256GB mSATA.
|
||||
Four sites are planned; the first is `gw-cnx-1` (Chiang Mai). Everything lives
|
||||
in the reusable `modules/router/` module (`cnx.router.*` options); a site's
|
||||
machine config only sets port names, VLANs, and feature flags.
|
||||
|
||||
Naming: `gw-<city>-<n>`, e.g. `gw-cnx-1`.
|
||||
|
||||
## What each gateway runs
|
||||
|
||||
| Function | Implementation |
|
||||
| ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| WAN | PPPoE (`pppd`), per-site ISP credentials via clan vars prompts; `wan.vlanId` when the ISP tags the session (AIS: 10); `wan.macAddress` to clone the old router's MAC if the ISP has it pinned |
|
||||
| LAN | VLAN-filtering bridge `br0` over the trunk ports (networkd) |
|
||||
| Firewall/NAT | nftables: default-deny WAN, no inter-VLAN, MSS clamp, v4 NAT |
|
||||
| DHCP | Kea, one subnet per VLAN |
|
||||
| DNS | Blocky (blocklist resolver), metrics on :4000 scraped by control |
|
||||
| IPv6 | DHCPv6-PD on ppp0, /64 per VLAN via SLAAC |
|
||||
| Bans | CrowdSec + nftables bouncer (sshd log parsing) |
|
||||
| Omada | Optional per site: TP-Link Omada controller as a podman container |
|
||||
| Management | ZeroTier mesh: SSH, node_exporter, journald upload — like the fleet |
|
||||
| Storage | Single-disk ZFS (zstd, `/var` its own dataset for snapshots) |
|
||||
|
||||
## Addressing plan
|
||||
|
||||
Each site owns `10.<siteId>.0.0/16`. Defaults per VLAN: subnet
|
||||
`10.<siteId>.<vlanId>.0/24`, router at `.1`, DHCP pool `.100–.199`
|
||||
(`.2–.99` static/infra, `.200–.254` reserved).
|
||||
|
||||
VLAN id convention (fleet-wide): **10 = mgmt**, **20 = lan** (both mandatory at
|
||||
every site), 30 = guest, 40 = iot (reserved). Sites add their own beyond that.
|
||||
|
||||
Larger subnets (e.g. public-WiFi guest networks that outgrow a /24) are carved
|
||||
from the **upper half** `10.<siteId>.128.0/17` and set explicitly on the VLAN.
|
||||
The lower half stays reserved for /24s indexed by VLAN id. High-churn VLANs
|
||||
should also shorten `dhcp.leaseTime` (default 86400 s) so the pool recycles.
|
||||
First user: `gw-cnx-2` (site 2) runs the public WiFi — guest VLAN 30 at
|
||||
`10.2.128.0/22`, pool `10.2.128.100 – 10.2.131.250`, `dhcp.leaseTime = 3600`.
|
||||
|
||||
| Site | siteId | mgmt | lan |
|
||||
| ---- | ------ | -------------- | -------------- |
|
||||
| cnx | 1 | `10.1.10.0/24` | `10.1.20.0/24` |
|
||||
|
||||
Trust model: mgmt → everything; other VLANs → router DNS/DHCP + internet only
|
||||
(no inter-VLAN); WAN → nothing inbound; mesh → SSH, metrics, Omada UI.
|
||||
|
||||
## Adding a site
|
||||
|
||||
1. Copy `machines/gw-cnx-1/` to `machines/gw-<city>-<n>/`; set `site`,
|
||||
`siteId` (next free number), port names, VLANs, and `omada.enable`.
|
||||
Fill the real disk id in `disko.nix` (from the installer:
|
||||
`ls -l /dev/disk/by-id/`). Keep the `mgmt`/`lan` VLANs.
|
||||
2. Add the machine to `inventory.machines` in `clan.nix` and to the machine
|
||||
list in `modules/mesh-hosts.nix`. Do **not** add it to `modules/hosts.nix`
|
||||
(dynamic PPPoE IP; clan connects over the mesh).
|
||||
3. Add its node_exporter and Blocky scrape targets in
|
||||
`modules/monitoring/server.nix`.
|
||||
4. `git add` the new machine directory — flake evaluation only sees
|
||||
git-tracked files, so an untracked `machines/gw-…/` is silently ignored.
|
||||
5. `clan vars generate gw-<city>-<n>` — prompts for the site's PPPoE
|
||||
credentials, mints the ZeroTier identity etc. (`nix flake check` fails
|
||||
until this has run, because mesh-hosts reads the ZeroTier IP var.)
|
||||
6. Boot the box from a NixOS installer USB on the local network, then:
|
||||
`clan machines install gw-<city>-<n> --target-host root@<lan-ip>`
|
||||
7. Check `facter.json` for the real NIC names, fix `wan.interface` /
|
||||
`trunkPorts` if the enumeration differs, and
|
||||
`clan machines update gw-<city>-<n>` (rides the mesh from then on).
|
||||
8. Add a row to the site table above and to the machines table in
|
||||
[Overview](./overview.md).
|
||||
|
||||
## Omada controller
|
||||
|
||||
Sites with TP-Link Omada APs/switches set `cnx.router.omada.enable = true`.
|
||||
The controller runs as a podman container (`mbentley/omada-controller` — there
|
||||
is no nixpkgs package) with host networking on the mgmt VLAN, where adoption
|
||||
broadcasts (UDP 29810) live. UI: `https://<mgmt-addr>:8043` from mgmt, or the
|
||||
gateway's mesh address from an admin machine. Controller state is under
|
||||
`/var/lib/omada`, declared as clan state (`clan.core.state.omada`); wiring it
|
||||
into the borgbackup instance is still a follow-up.
|
||||
|
||||
## Runbook
|
||||
|
||||
- **PPPoE down**: `systemctl status pppd-wan`, `journalctl -u pppd-wan` on the
|
||||
gateway (over the mesh). ISP credentials live in the `pppoe-credentials`
|
||||
vars generator; re-enter with `clan vars generate gw-<city>-<n> --regenerate`.
|
||||
- **A VLAN gets no leases**: `systemctl status kea-dhcp4-server`; check the
|
||||
port's `bridgeVLANs` tagging and that the switch trunk carries the VLAN.
|
||||
- **DNS/blocklist issues**: Blocky metrics are in VictoriaMetrics (job
|
||||
`blocky`); `journalctl -u blocky` on the gateway.
|
||||
- **Banned yourself**: `cscli decisions list` / `cscli decisions delete --ip <ip>`
|
||||
on the gateway. The ZeroTier mesh `/88` is whitelisted at the parser stage
|
||||
(`cnx/mesh-whitelist`), so admin access over the mesh can never be banned.
|
||||
|
||||
## Follow-ups
|
||||
|
||||
- Borgbackup client for Omada + Kea lease state.
|
||||
- Suricata (IDS-only) if CPU headroom allows — deliberately skipped for now.
|
||||
- Remaining three sites.
|
||||
@@ -0,0 +1,90 @@
|
||||
# Mail
|
||||
|
||||
A single mail server, `mx1`, runs the [Simple NixOS Mailserver](https://nixos-mailserver.readthedocs.io/)
|
||||
stack (Postfix + Dovecot + Rspamd + OpenDKIM) for the `cnx.email` domain. All of
|
||||
it is declared in `modules/mail.nix`, imported by `machines/mx1/configuration.nix`.
|
||||
|
||||
Mailboxes are **virtual** (not system users): each address is a login account
|
||||
whose password is a four-word passphrase auto-generated by a clan vars generator
|
||||
(e.g. `otter-lantern-cobalt-driftwood-42`). The generator stores both the
|
||||
passphrase (handed to the user) and its sha-512 hash (consumed by SNM); plaintext
|
||||
never lands in the repo.
|
||||
|
||||
The mail cert is obtained by `mx1` itself via ACME DNS-01 against `ns1` (key
|
||||
`acme_mx1`), and carries `mx1.cnx.email` plus the `mta-sts.cnx.email` and
|
||||
`mail.cnx.email` SANs. See [DNS → ACME DNS-01](./dns.md#acme-dns-01).
|
||||
|
||||
## Add a mailbox
|
||||
|
||||
1. Append the address to `accounts` in `modules/mail.nix`:
|
||||
```nix
|
||||
accounts = [
|
||||
"postmaster@cnx.email"
|
||||
"alice@cnx.email" # new
|
||||
];
|
||||
```
|
||||
2. Mint its generated password (user-run, YubiKey touch):
|
||||
```
|
||||
clan vars generate mx1
|
||||
```
|
||||
3. Redeploy: `clan machines update mx1`.
|
||||
4. Hand the passphrase to the user. The generator name replaces `@`→`-at-` and
|
||||
`.`→`-`:
|
||||
```
|
||||
clan vars get mx1 mail-passwd-alice-at-cnx-email/passphrase
|
||||
```
|
||||
|
||||
The DMARC report inbox (`dmarc@cnx.email`) is special: its password comes from
|
||||
the **shared** `mail-dmarc-cred` generator (not the per-machine set) so parsedmarc
|
||||
on `control` can read the same passphrase over the mesh.
|
||||
|
||||
## Add a domain
|
||||
|
||||
Adding a second mail domain is more than a config line — it needs its own DNS
|
||||
records and DKIM key. Steps:
|
||||
|
||||
1. **Serve the zone** (if not already): add it in `modules/dns/domains.nix` and
|
||||
drop a `<domain>.zone` file — see [DNS](./dns.md).
|
||||
2. **Declare the domain** in `modules/mail.nix`:
|
||||
```nix
|
||||
mailserver.domains = [ "cnx.email" "newdomain.tld" ];
|
||||
```
|
||||
Add at least a `postmaster@newdomain.tld` account (RFC 5321 requires it) the
|
||||
same way as above.
|
||||
3. **Publish the mail DNS records** in the new zone, mirroring `cnx.email`'s
|
||||
`; ---- Mail ----` block:
|
||||
- `MX 10 mx1.cnx.email.` — point at the existing MX; do **not** stand up a new
|
||||
hostname unless you really want a separate server.
|
||||
- SPF: `@ TXT "v=spf1 mx -all"`.
|
||||
- DKIM: SNM generates a key per domain on first start under
|
||||
`mailserver.dkimKeyDirectory` (selector `mail`). After deploy, read the
|
||||
public key off `mx1` and paste it as `mail._domainkey TXT`. The private keys
|
||||
are declared as clan state and backed up.
|
||||
- DMARC: `_dmarc TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@cnx.email; ..."`
|
||||
— reports can keep flowing to the existing `dmarc@cnx.email` inbox.
|
||||
4. **DANE / MTA-STS are tied to `mx1.cnx.email`**, the MX hostname — they do **not**
|
||||
need duplicating per sending-domain. A new domain that uses `mx1.cnx.email` as
|
||||
its MX inherits the existing TLSA and MTA-STS policy. Only add new TLSA/MTA-STS
|
||||
records if you introduce a new MX hostname.
|
||||
5. `clan vars generate mx1` (if you added accounts), then
|
||||
`clan machines update mx1`.
|
||||
|
||||
## DKIM, DANE, MTA-STS reminders
|
||||
|
||||
These three are easy to get subtly wrong; the live records for `cnx.email` and
|
||||
the exact commands to regenerate them are in `modules/dns/zones/cnx.email.zone`:
|
||||
|
||||
- **DKIM** key rotation = regenerate under `dkimKeyDirectory`, then republish the
|
||||
`mail._domainkey TXT`.
|
||||
- **DANE TLSA** (`_25._tcp.mx1 TLSA 3 1 1 …`) is the SHA-256 of `mx1`'s cert
|
||||
**public key**. It stays valid across renewals because lego runs with
|
||||
`--reuse-key`; only recompute it if the key changes. The `openssl` one-liner is
|
||||
in the zone file.
|
||||
- **MTA-STS**: bump the `_mta-sts TXT` id **every time** the policy in
|
||||
`modules/mail.nix` changes, or senders keep the cached policy.
|
||||
|
||||
## DMARC reporting
|
||||
|
||||
`mx1` delivers aggregate/forensic DMARC reports to `dmarc@cnx.email`; parsedmarc
|
||||
on `control` polls that mailbox over the mesh and feeds the results into Grafana.
|
||||
See [Monitoring](./monitoring.md).
|
||||
+16
-7
@@ -6,13 +6,14 @@ this book is built from `docs/` and served on `control` over the ZeroTier mesh.
|
||||
|
||||
## Machines
|
||||
|
||||
| Machine | Role | Public IPv4 | Public IPv6 |
|
||||
| --------- | -------------------------------------- | ---------------- | ----------------------- |
|
||||
| `control` | ZeroTier controller, monitoring, docs | `77.42.68.181` | `2a01:4f9:c013:e6d0::1` |
|
||||
| `ns1` | Knot DNS **primary** (master) | `46.224.170.206` | `2a01:4f8:c014:b5c5::1` |
|
||||
| `ns2` | Knot DNS **secondary** (slave) | `157.180.70.82` | `2a01:4f9:c014:6d87::1` |
|
||||
| `mx1` | Mail server (**MX** for cnx.email) | `5.223.65.38` | `2a01:4ff:2f0:1963::1` |
|
||||
| `web01` | Public reverse proxy (TLS termination) | `5.223.55.246` | `2a01:4ff:2f0:2d8f::1` |
|
||||
| Machine | Role | Public IPv4 | Public IPv6 |
|
||||
| ---------- | -------------------------------------- | ---------------- | ----------------------- |
|
||||
| `control` | ZeroTier controller, monitoring, docs | `77.42.68.181` | `2a01:4f9:c013:e6d0::1` |
|
||||
| `ns1` | Knot DNS **primary** (master) | `46.224.170.206` | `2a01:4f8:c014:b5c5::1` |
|
||||
| `ns2` | Knot DNS **secondary** (slave) | `157.180.70.82` | `2a01:4f9:c014:6d87::1` |
|
||||
| `mx1` | Mail server (**MX** for cnx.email) | `5.223.65.38` | `2a01:4ff:2f0:1963::1` |
|
||||
| `web01` | Public reverse proxy (TLS termination) | `5.223.55.246` | `2a01:4ff:2f0:2d8f::1` |
|
||||
| `gw-cnx-1` | Site gateway Chiang Mai (router) | dynamic (PPPoE) | — |
|
||||
|
||||
## Access
|
||||
|
||||
@@ -21,6 +22,14 @@ this book is built from `docs/` and served on `control` over the ZeroTier mesh.
|
||||
- clan reaches machines by their public IPs first (the `internet` instance), with
|
||||
the mesh and Tor as automatic fallbacks.
|
||||
|
||||
## Host baseline
|
||||
|
||||
Every machine sets a fixed-offset `time.timeZone` and runs **chrony** for time
|
||||
sync (`services.chrony.enable`). chrony is the single NTP implementation across
|
||||
the fleet — do **not** use `systemd-timesyncd`; the two are mutually exclusive
|
||||
and we standardise on chrony everywhere. New hosts must set both the timezone and
|
||||
chrony as part of their baseline config.
|
||||
|
||||
## Editing these docs
|
||||
|
||||
Commit-to-edit: change the markdown under `docs/src/`, commit, and redeploy
|
||||
|
||||
Generated
+10
-10
@@ -29,11 +29,11 @@
|
||||
"treefmt-nix": "treefmt-nix"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1782204050,
|
||||
"narHash": "sha256-o8PXnm00Ecim/7WIQWxnFciWxvxgbll9fxH5MJ3a1Kg=",
|
||||
"rev": "246e2bcba4dc9c009a96d017c030c7a53c83955e",
|
||||
"lastModified": 1783497933,
|
||||
"narHash": "sha256-TxmwEews6URFPqOWEHNychtXbFDgLZjbOfEXtvtOm6U=",
|
||||
"rev": "3dc0221ca09033599fe98055e9bbc81bdf32732a",
|
||||
"type": "tarball",
|
||||
"url": "https://git.clan.lol/api/v1/repos/clan/clan-core/archive/246e2bcba4dc9c009a96d017c030c7a53c83955e.tar.gz"
|
||||
"url": "https://git.clan.lol/api/v1/repos/clan/clan-core/archive/3dc0221ca09033599fe98055e9bbc81bdf32732a.tar.gz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
@@ -217,11 +217,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781301671,
|
||||
"narHash": "sha256-rq6WOopxq3U2AGEWO80o9LIJDYcYIdgw6jyl+y+19w8=",
|
||||
"lastModified": 1785198005,
|
||||
"narHash": "sha256-falBPi+PJtMx0vwII8L24wjDGXNZMwRiVXsw8WTXLEo=",
|
||||
"owner": "simple-nixos-mailserver",
|
||||
"repo": "nixos-mailserver",
|
||||
"rev": "661ec59a97ccee13a63f79280b282eb6f7d3f817",
|
||||
"rev": "d357b9f048c5532ec81b0e0034c0b8463d5ddd46",
|
||||
"type": "gitlab"
|
||||
},
|
||||
"original": {
|
||||
@@ -320,11 +320,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1780220602,
|
||||
"narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
|
||||
"lastModified": 1784369104,
|
||||
"narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=",
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"rev": "db947814a175b7ca6ded66e21383d938df01c227",
|
||||
"rev": "df3c0640565d04a0261253cdd89fce78ec50168a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
@@ -59,13 +59,39 @@
|
||||
|
||||
# Add the Clan cli tool to the dev shell.
|
||||
# Use "nix develop" to enter the dev shell.
|
||||
devShells = forAllSystems (system: {
|
||||
default = (pkgsFor system).mkShell {
|
||||
packages = [
|
||||
clan-core.packages.${system}.clan-cli
|
||||
(treefmtFor system).config.build.wrapper
|
||||
];
|
||||
};
|
||||
});
|
||||
devShells = forAllSystems (
|
||||
system:
|
||||
let
|
||||
clanCli = clan-core.packages.${system}.clan-cli;
|
||||
# `clan machines update a b c` normally runs machines in parallel,
|
||||
# which interleaves their output and buries the YubiKey PIN prompts.
|
||||
# This wrapper (first in PATH) runs them one at a time instead; any
|
||||
# flags fall through to the real CLI untouched.
|
||||
clanSequential = (pkgsFor system).writeShellScriptBin "clan" ''
|
||||
if [ "$#" -gt 3 ] && [ "$1" = machines ] && [ "$2" = update ]; then
|
||||
shift 2
|
||||
for arg in "$@"; do
|
||||
case "$arg" in
|
||||
-*) exec ${clanCli}/bin/clan machines update "$@" ;;
|
||||
esac
|
||||
done
|
||||
for machine in "$@"; do
|
||||
${clanCli}/bin/clan machines update "$machine" || exit
|
||||
done
|
||||
exit 0
|
||||
fi
|
||||
exec ${clanCli}/bin/clan "$@"
|
||||
'';
|
||||
in
|
||||
{
|
||||
default = (pkgsFor system).mkShell {
|
||||
packages = [
|
||||
clanSequential
|
||||
clanCli
|
||||
(treefmtFor system).config.build.wrapper
|
||||
];
|
||||
};
|
||||
}
|
||||
);
|
||||
};
|
||||
}
|
||||
|
||||
@@ -14,8 +14,6 @@ in
|
||||
../../modules/docs.nix
|
||||
];
|
||||
|
||||
clan.core.sops.defaultGroups = [ "admins" ];
|
||||
|
||||
# Public IPv6 (from modules/hosts.nix); SLAAC doesn't bring it up here.
|
||||
cnx.staticIPv6 = {
|
||||
enable = true;
|
||||
@@ -23,7 +21,7 @@ in
|
||||
};
|
||||
|
||||
time.timeZone = "Etc/GMT-3"; # UTC+3 (fixed offset, no DST)
|
||||
services.timesyncd.enable = true;
|
||||
services.chrony.enable = true;
|
||||
|
||||
# Public Hetzner Cloud firewalls, synced from this config on every deploy.
|
||||
# Rules live in their own data file; see that file for the no-public-SSH note.
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
# Site gateway Chiang Mai (site 1): Topton 1U, Intel N300, 4x i226-V 2.5G.
|
||||
# Port roles below use the expected igc names — verify against facter.json
|
||||
# after the first install and adjust if the box enumerates differently.
|
||||
{ config, lib, ... }:
|
||||
{
|
||||
imports = [
|
||||
../../modules/router
|
||||
../../modules/monitoring/exporters.nix
|
||||
];
|
||||
|
||||
# Until the install generates facter.json (which normally provides this).
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
|
||||
# ZFS (disko.nix) needs a stable machine-unique hostId; derive it from the
|
||||
# hostname so every gateway gets one for free when copied for a new site.
|
||||
networking.hostId = builtins.substring 0 8 (
|
||||
builtins.hashString "sha256" config.networking.hostName
|
||||
);
|
||||
|
||||
cnx.router = {
|
||||
enable = true;
|
||||
site = "cnx";
|
||||
siteId = 1;
|
||||
wan.interface = "enp1s0";
|
||||
wan.vlanId = 10; # AIS delivers PPPoE tagged on VLAN 10
|
||||
trunkPorts = [
|
||||
"enp2s0"
|
||||
"enp3s0"
|
||||
"enp4s0"
|
||||
];
|
||||
vlans = {
|
||||
mgmt.id = 10; # 10.1.10.0/24 — APs, switches, Omada, admin
|
||||
lan.id = 20; # 10.1.20.0/24 — trusted clients
|
||||
};
|
||||
# This site runs the Omada controller for its APs/switches.
|
||||
omada.enable = true;
|
||||
};
|
||||
|
||||
time.timeZone = "Etc/GMT-7"; # UTC+7 (Thailand, fixed offset, no DST)
|
||||
services.chrony.enable = true;
|
||||
}
|
||||
@@ -0,0 +1,78 @@
|
||||
# Single-disk ZFS layout for the Topton's 256GB mSATA SSD: vfat ESP for boot,
|
||||
# the rest a zpool (zstd compression, no atime). Single disk = no redundancy;
|
||||
# ZFS buys us compression, snapshots, and checksumming. Requires
|
||||
# networking.hostId (set in configuration.nix). The device is a placeholder:
|
||||
# boot the installer, read the real id from `ls -l /dev/disk/by-id/`, and fill
|
||||
# it in before `clan machines install`. Changing the layout later requires
|
||||
# wiping and reinstalling.
|
||||
{
|
||||
|
||||
boot.loader.grub.efiSupport = true;
|
||||
boot.loader.grub.efiInstallAsRemovable = true;
|
||||
boot.loader.grub.enable = true;
|
||||
disko.devices = {
|
||||
disk = {
|
||||
main = {
|
||||
name = "main-gw-cnx-1";
|
||||
device = "/dev/disk/by-id/CHANGE-ME-msata-ssd";
|
||||
type = "disk";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
"boot" = {
|
||||
size = "1M";
|
||||
type = "EF02"; # for grub MBR
|
||||
priority = 1;
|
||||
};
|
||||
ESP = {
|
||||
type = "EF00";
|
||||
size = "500M";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "umask=0077" ];
|
||||
};
|
||||
};
|
||||
zfs = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "zfs";
|
||||
pool = "rpool";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
zpool = {
|
||||
rpool = {
|
||||
type = "zpool";
|
||||
options.ashift = "12";
|
||||
rootFsOptions = {
|
||||
compression = "zstd";
|
||||
acltype = "posixacl";
|
||||
xattr = "sa";
|
||||
atime = "off";
|
||||
mountpoint = "none";
|
||||
};
|
||||
datasets = {
|
||||
root = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/";
|
||||
};
|
||||
nix = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/nix";
|
||||
};
|
||||
# Service state (Omada, Kea leases, CrowdSec db, journald) — its own
|
||||
# dataset so it can be snapshotted/sent independently of the OS.
|
||||
var = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/var";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -10,8 +10,6 @@ in
|
||||
../../modules/monitoring/exporters.nix
|
||||
];
|
||||
|
||||
clan.core.sops.defaultGroups = [ "admins" ];
|
||||
|
||||
# Public IPv6 (from modules/hosts.nix); SLAAC doesn't bring it up here.
|
||||
cnx.staticIPv6 = {
|
||||
enable = true;
|
||||
@@ -19,5 +17,5 @@ in
|
||||
};
|
||||
|
||||
time.timeZone = "Etc/GMT-8"; # UTC+8 (Singapore, fixed offset, no DST)
|
||||
services.timesyncd.enable = true;
|
||||
services.chrony.enable = true;
|
||||
}
|
||||
|
||||
@@ -18,8 +18,6 @@ in
|
||||
../../modules/monitoring/exporters.nix
|
||||
];
|
||||
|
||||
clan.core.sops.defaultGroups = [ "admins" ];
|
||||
|
||||
# Knot's state dir holds the non-regenerable DNSSEC key material (KSK/ZSK
|
||||
# private keys in the KASP keystore). Declaring it as clan state makes the
|
||||
# borgbackup client back it up; losing it forces an emergency DS rollover at
|
||||
@@ -38,7 +36,7 @@ in
|
||||
};
|
||||
|
||||
time.timeZone = "Etc/GMT-1"; # UTC+1 (fixed offset, no DST)
|
||||
services.timesyncd.enable = true;
|
||||
services.chrony.enable = true;
|
||||
|
||||
# ACME DNS-01 (RFC 2136), general key. A dedicated TSIG key scoped by acl_acme
|
||||
# (referenced by every zone below) to TXT updates at or under _acme-challenge.
|
||||
|
||||
@@ -10,8 +10,6 @@ in
|
||||
../../modules/monitoring/exporters.nix
|
||||
];
|
||||
|
||||
clan.core.sops.defaultGroups = [ "admins" ];
|
||||
|
||||
# Public IPv6 (from modules/hosts.nix; matches the ns2 AAAA glue); SLAAC
|
||||
# doesn't bring it up here.
|
||||
cnx.staticIPv6 = {
|
||||
@@ -20,7 +18,7 @@ in
|
||||
};
|
||||
|
||||
time.timeZone = "Etc/GMT-3"; # UTC+3 (fixed offset, no DST)
|
||||
services.timesyncd.enable = true;
|
||||
services.chrony.enable = true;
|
||||
|
||||
# ns2 = secondary (slave): pulls every zone from ns1 and accepts its NOTIFY.
|
||||
services.knot.settings.zone = map (d: {
|
||||
|
||||
@@ -9,8 +9,6 @@ in
|
||||
../../modules/web-proxy.nix
|
||||
];
|
||||
|
||||
clan.core.sops.defaultGroups = [ "admins" ];
|
||||
|
||||
# Public IPv6 (from modules/hosts.nix); SLAAC doesn't bring it up here.
|
||||
cnx.staticIPv6 = {
|
||||
enable = true;
|
||||
@@ -18,5 +16,5 @@ in
|
||||
};
|
||||
|
||||
time.timeZone = "Etc/GMT-8"; # UTC+8 (Singapore, fixed offset, no DST)
|
||||
services.timesyncd.enable = true;
|
||||
services.chrony.enable = true;
|
||||
}
|
||||
|
||||
@@ -23,6 +23,7 @@ let
|
||||
"ns2"
|
||||
"mx1"
|
||||
"web01"
|
||||
"gw-cnx-1"
|
||||
] readIp;
|
||||
|
||||
# RFC 4193 prefix of this ZeroTier network: fd + the 8-byte network id + the
|
||||
|
||||
@@ -48,6 +48,13 @@ in
|
||||
(target "ns2" (v6 mesh.hosts.ns2) 9100)
|
||||
(target "mx1" (v6 mesh.hosts.mx1) 9100)
|
||||
(target "web01" (v6 mesh.hosts.web01) 9100)
|
||||
(target "gw-cnx-1" (v6 mesh.hosts.gw-cnx-1) 9100)
|
||||
];
|
||||
}
|
||||
{
|
||||
job_name = "blocky";
|
||||
static_configs = [
|
||||
(target "gw-cnx-1" (v6 mesh.hosts.gw-cnx-1) 4000)
|
||||
];
|
||||
}
|
||||
{
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
# CrowdSec security engine + nftables bouncer: parses sshd auth attempts from
|
||||
# the journal and bans offending source IPs at the firewall. Log-based (no
|
||||
# inline DPI) so it costs the N300 next to nothing.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.cnx.router;
|
||||
mesh = import ../mesh-hosts.nix { inherit config lib; };
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.crowdsec = {
|
||||
enable = true;
|
||||
autoUpdateService = true;
|
||||
hub.collections = [
|
||||
"crowdsecurity/linux"
|
||||
"crowdsecurity/sshd"
|
||||
];
|
||||
localConfig = {
|
||||
acquisitions = [
|
||||
{
|
||||
source = "journalctl";
|
||||
journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
|
||||
labels.type = "syslog";
|
||||
}
|
||||
];
|
||||
# Never ban the ZeroTier mesh — it is the only admin path to these
|
||||
# boxes (no public SSH), so a false positive would lock us out.
|
||||
# Parser-stage whitelist: mesh events are dropped before any scenario.
|
||||
parsers.s02Enrich = [
|
||||
{
|
||||
name = "cnx/mesh-whitelist";
|
||||
description = "Whitelist the ZeroTier management mesh";
|
||||
whitelist = {
|
||||
reason = "ZeroTier mesh is the admin path";
|
||||
cidr = [ mesh.subnet ];
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
services.crowdsec-firewall-bouncer = {
|
||||
enable = true;
|
||||
registerBouncer.enable = true;
|
||||
settings.mode = "nftables";
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,253 @@
|
||||
# Site gateway (OPNsense replacement) for the Topton 1U boxes: PPPoE WAN,
|
||||
# VLAN-filtering bridge over the LAN ports, and per-VLAN L3 interfaces.
|
||||
# Imported by machines/gw-<city>-<n>; everything is driven by cnx.router.*.
|
||||
#
|
||||
# Fleet addressing convention: each site owns 10.<siteId>.0.0/16. A VLAN's
|
||||
# subnet defaults to 10.<siteId>.<vlanId>.0/24 with the router at .1 and the
|
||||
# DHCP pool at .100-.199. VLANs that need more space (e.g. public-wifi guest)
|
||||
# override `subnet`/`address`/`dhcp.pool` and take a wider block from the
|
||||
# upper half (10.<siteId>.128.0/17), e.g. guest -> 10.<siteId>.128.0/22.
|
||||
# VLAN ids: 10 = mgmt, 20 = lan (mandatory); 30 = guest, 40 = iot (reserved).
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.cnx.router;
|
||||
|
||||
vlanIf = name: "vlan-${name}";
|
||||
site = toString cfg.siteId;
|
||||
|
||||
vlanModule =
|
||||
{ name, config, ... }:
|
||||
let
|
||||
octet = toString config.id;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
id = lib.mkOption {
|
||||
type = lib.types.ints.between 1 4094;
|
||||
description = "802.1Q VLAN id (fleet convention: 10 mgmt, 20 lan, 30 guest, 40 iot).";
|
||||
};
|
||||
address = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "10.${site}.${octet}.1";
|
||||
description = "Router address on this VLAN.";
|
||||
};
|
||||
prefixLength = lib.mkOption {
|
||||
type = lib.types.ints.between 8 30;
|
||||
default = 24;
|
||||
};
|
||||
subnet = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "10.${site}.${octet}.0/24";
|
||||
description = "The VLAN's network in CIDR form (must contain `address`).";
|
||||
};
|
||||
dhcp = {
|
||||
enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
};
|
||||
pool = {
|
||||
from = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "10.${site}.${octet}.100";
|
||||
};
|
||||
to = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "10.${site}.${octet}.199";
|
||||
};
|
||||
};
|
||||
leaseTime = lib.mkOption {
|
||||
type = lib.types.ints.positive;
|
||||
default = 86400;
|
||||
description = ''
|
||||
Lease validity in seconds. Lower it for high-churn networks,
|
||||
e.g. public-WiFi guest VLANs (3600-7200), so the pool recycles.
|
||||
'';
|
||||
};
|
||||
};
|
||||
allowWan = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "Whether clients on this VLAN may reach the internet.";
|
||||
};
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./pppoe.nix
|
||||
./ipv6.nix
|
||||
./firewall.nix
|
||||
./dns-dhcp.nix
|
||||
./crowdsec.nix
|
||||
./omada.nix
|
||||
];
|
||||
|
||||
options.cnx.router = {
|
||||
enable = lib.mkEnableOption "site gateway (router) role";
|
||||
|
||||
site = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "City code of the site, e.g. \"cnx\".";
|
||||
};
|
||||
|
||||
siteId = lib.mkOption {
|
||||
type = lib.types.ints.between 1 254;
|
||||
description = "Site number; drives the 10.<siteId>.<vlan>.0/24 addressing.";
|
||||
};
|
||||
|
||||
wan.interface = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Physical WAN port the PPPoE session runs on.";
|
||||
};
|
||||
|
||||
wan.vlanId = lib.mkOption {
|
||||
type = lib.types.nullOr (lib.types.ints.between 1 4094);
|
||||
default = null;
|
||||
description = ''
|
||||
802.1Q tag the ISP requires for the PPPoE session (AIS Thailand: 10);
|
||||
null for untagged PPPoE directly on the port. Unrelated to the LAN
|
||||
VLANs — this tag exists only on the WAN port.
|
||||
'';
|
||||
};
|
||||
|
||||
wan.macAddress = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = null;
|
||||
example = "aa:bb:cc:dd:ee:ff";
|
||||
description = ''
|
||||
Spoofed MAC for the WAN port, e.g. to keep the MAC the ISP has
|
||||
pinned (cloned from the old router). null keeps the hardware MAC.
|
||||
'';
|
||||
};
|
||||
|
||||
wan.pppInterface = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
internal = true;
|
||||
readOnly = true;
|
||||
default = if cfg.wan.vlanId == null then cfg.wan.interface else "wan-vlan";
|
||||
description = "Interface pppd dials on (the WAN port or its ISP VLAN).";
|
||||
};
|
||||
|
||||
trunkPorts = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
description = "LAN ports carrying all VLANs tagged (incl. any 10G SFP+ ports).";
|
||||
};
|
||||
|
||||
vlans = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.submodule vlanModule);
|
||||
description = "VLANs served at this site; `mgmt` and `lan` are mandatory.";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
assertions = [
|
||||
{
|
||||
assertion = cfg.vlans ? mgmt && cfg.vlans ? lan;
|
||||
message = "cnx.router: every site must define the `mgmt` and `lan` VLANs.";
|
||||
}
|
||||
];
|
||||
|
||||
networking.useNetworkd = true;
|
||||
networking.useDHCP = false;
|
||||
systemd.network.enable = true;
|
||||
|
||||
systemd.network.netdevs = {
|
||||
"20-br0" = {
|
||||
netdevConfig = {
|
||||
Name = "br0";
|
||||
Kind = "bridge";
|
||||
};
|
||||
bridgeConfig.VLANFiltering = true;
|
||||
};
|
||||
}
|
||||
// lib.optionalAttrs (cfg.wan.vlanId != null) {
|
||||
"15-wan-vlan" = {
|
||||
netdevConfig = {
|
||||
Name = "wan-vlan";
|
||||
Kind = "vlan";
|
||||
};
|
||||
vlanConfig.Id = cfg.wan.vlanId;
|
||||
};
|
||||
}
|
||||
// lib.mapAttrs' (
|
||||
name: vlan:
|
||||
lib.nameValuePair "30-${vlanIf name}" {
|
||||
netdevConfig = {
|
||||
Name = vlanIf name;
|
||||
Kind = "vlan";
|
||||
};
|
||||
vlanConfig.Id = vlan.id;
|
||||
}
|
||||
) cfg.vlans;
|
||||
|
||||
systemd.network.networks =
|
||||
let
|
||||
taggedAll = lib.mapAttrsToList (_: vlan: { VLAN = vlan.id; }) cfg.vlans;
|
||||
in
|
||||
{
|
||||
# WAN port carries only the PPPoE session; no IP config of its own.
|
||||
"10-wan" = {
|
||||
matchConfig.Name = cfg.wan.interface;
|
||||
networkConfig.LinkLocalAddressing = "no";
|
||||
vlan = lib.optional (cfg.wan.vlanId != null) "wan-vlan";
|
||||
linkConfig = {
|
||||
RequiredForOnline = "carrier";
|
||||
}
|
||||
# The wan-vlan subinterface (and thus the PPPoE session) inherits
|
||||
# the parent port's MAC, so spoofing here covers both cases.
|
||||
// lib.optionalAttrs (cfg.wan.macAddress != null) {
|
||||
MACAddress = cfg.wan.macAddress;
|
||||
};
|
||||
};
|
||||
}
|
||||
// lib.optionalAttrs (cfg.wan.vlanId != null) {
|
||||
# The ISP-side VLAN subinterface pppd dials on (e.g. AIS tags PPPoE).
|
||||
"15-wan-vlan" = {
|
||||
matchConfig.Name = "wan-vlan";
|
||||
networkConfig.LinkLocalAddressing = "no";
|
||||
linkConfig.RequiredForOnline = "no";
|
||||
};
|
||||
}
|
||||
// {
|
||||
# The bridge itself is L2-only; L3 lives on the vlan-* interfaces,
|
||||
# which hang off the bridge (tagged on the bridge "self" port).
|
||||
"20-br0" = {
|
||||
matchConfig.Name = "br0";
|
||||
networkConfig.LinkLocalAddressing = "no";
|
||||
vlan = lib.mapAttrsToList (name: _: vlanIf name) cfg.vlans;
|
||||
bridgeVLANs = taggedAll;
|
||||
linkConfig.RequiredForOnline = "no";
|
||||
};
|
||||
}
|
||||
// lib.listToAttrs (
|
||||
map (port: {
|
||||
name = "25-trunk-${port}";
|
||||
value = {
|
||||
matchConfig.Name = port;
|
||||
networkConfig.Bridge = "br0";
|
||||
bridgeVLANs = taggedAll;
|
||||
linkConfig.RequiredForOnline = "no";
|
||||
};
|
||||
}) cfg.trunkPorts
|
||||
)
|
||||
// lib.mapAttrs' (
|
||||
name: vlan:
|
||||
lib.nameValuePair "40-${vlanIf name}" {
|
||||
matchConfig.Name = vlanIf name;
|
||||
address = [ "${vlan.address}/${toString vlan.prefixLength}" ];
|
||||
networkConfig = {
|
||||
IPv6AcceptRA = false;
|
||||
# Announce a /64 carved from the DHCPv6-PD prefix on ppp0 (SLAAC).
|
||||
IPv6SendRA = true;
|
||||
DHCPPrefixDelegation = true;
|
||||
};
|
||||
dhcpPrefixDelegationConfig.SubnetId = "auto";
|
||||
linkConfig.RequiredForOnline = "no";
|
||||
}
|
||||
) cfg.vlans;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,79 @@
|
||||
# LAN DHCP (Kea) and DNS (Blocky). Fully declarative: one Kea subnet per VLAN
|
||||
# with dhcp.enable, Blocky as the blocklist resolver every DHCP lease points
|
||||
# at. Blocky's HTTP listener (:4000) serves Prometheus metrics, scraped by
|
||||
# control over the mesh (firewall.nix scopes it to the mesh subnet).
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.cnx.router;
|
||||
dhcpVlans = lib.filterAttrs (_: vlan: vlan.dhcp.enable) cfg.vlans;
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.kea.dhcp4 = {
|
||||
enable = true;
|
||||
settings = {
|
||||
interfaces-config.interfaces = lib.mapAttrsToList (name: _: "vlan-${name}") dhcpVlans;
|
||||
lease-database = {
|
||||
type = "memfile";
|
||||
persist = true;
|
||||
name = "/var/lib/kea/dhcp4.leases";
|
||||
};
|
||||
valid-lifetime = 86400;
|
||||
subnet4 = lib.mapAttrsToList (name: vlan: {
|
||||
id = vlan.id;
|
||||
subnet = vlan.subnet;
|
||||
interface = "vlan-${name}";
|
||||
valid-lifetime = vlan.dhcp.leaseTime;
|
||||
pools = [ { pool = "${vlan.dhcp.pool.from} - ${vlan.dhcp.pool.to}"; } ];
|
||||
option-data = [
|
||||
{
|
||||
name = "routers";
|
||||
data = vlan.address;
|
||||
}
|
||||
{
|
||||
name = "domain-name-servers";
|
||||
data = vlan.address;
|
||||
}
|
||||
];
|
||||
}) dhcpVlans;
|
||||
};
|
||||
};
|
||||
|
||||
services.blocky = {
|
||||
enable = true;
|
||||
settings = {
|
||||
ports = {
|
||||
dns = 53;
|
||||
http = 4000;
|
||||
};
|
||||
upstreams.groups.default = [
|
||||
"9.9.9.9"
|
||||
"149.112.112.112"
|
||||
"2620:fe::fe"
|
||||
];
|
||||
blocking = {
|
||||
denylists.ads = [
|
||||
"https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts"
|
||||
];
|
||||
clientGroupsBlock.default = [ "ads" ];
|
||||
};
|
||||
caching = {
|
||||
minTime = "5m";
|
||||
prefetching = true;
|
||||
};
|
||||
prometheus.enable = true;
|
||||
};
|
||||
};
|
||||
|
||||
# The router itself resolves via public resolvers, not via Blocky, so DNS
|
||||
# for deploys/updates survives a broken local resolver.
|
||||
networking.nameservers = [
|
||||
"9.9.9.9"
|
||||
"1.1.1.1"
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,62 @@
|
||||
# Router firewall/NAT policy (nftables). Trust model:
|
||||
# mgmt VLAN -> trusted: router services, all VLANs, WAN
|
||||
# other VLANs -> DNS/DHCP on the router + WAN (if allowWan); no inter-VLAN
|
||||
# WAN (ppp0) -> nothing inbound beyond established/related
|
||||
# mesh -> admin SSH + metrics scrapes (same trust boundary as the fleet)
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.cnx.router;
|
||||
mesh = import ../mesh-hosts.nix { inherit config lib; };
|
||||
|
||||
vlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") cfg.vlans;
|
||||
wanVlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") (
|
||||
lib.filterAttrs (_: vlan: vlan.allowWan) cfg.vlans
|
||||
);
|
||||
nonMgmtIfs = lib.filter (i: i != "vlan-mgmt") vlanIfs;
|
||||
ifSet = ifs: "{ ${lib.concatStringsSep ", " (map (i: "\"${i}\"") ifs)} }";
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
networking.nftables.enable = true;
|
||||
|
||||
# SSH reachable only from the mgmt VLAN (trusted) and the mesh — never
|
||||
# from the WAN or the other VLANs.
|
||||
services.openssh.openFirewall = false;
|
||||
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
filterForward = true;
|
||||
trustedInterfaces = [ "vlan-mgmt" ];
|
||||
|
||||
# Non-mgmt VLANs may only talk to the router's DNS and DHCP.
|
||||
interfaces = lib.genAttrs nonMgmtIfs (_: {
|
||||
allowedTCPPorts = [ 53 ];
|
||||
allowedUDPPorts = [
|
||||
53
|
||||
67
|
||||
];
|
||||
});
|
||||
|
||||
extraInputRules = ''
|
||||
ip6 saddr ${mesh.subnet} tcp dport 22 accept comment "admin ssh over the mesh"
|
||||
ip6 saddr ${mesh.subnet} tcp dport 4000 accept comment "blocky metrics scrape from control"
|
||||
'';
|
||||
|
||||
extraForwardRules = ''
|
||||
tcp flags syn tcp option maxseg size set rt mtu comment "MSS clamp for PPPoE mtu 1492"
|
||||
iifname "vlan-mgmt" accept comment "mgmt reaches all VLANs and the WAN"
|
||||
iifname ${ifSet wanVlanIfs} oifname "ppp0" accept comment "LAN to internet"
|
||||
'';
|
||||
};
|
||||
|
||||
networking.nat = {
|
||||
enable = true;
|
||||
externalInterface = "ppp0";
|
||||
internalInterfaces = vlanIfs;
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
# IPv6 on the PPPoE uplink: run networkd's DHCPv6 client on ppp0 to obtain a
|
||||
# delegated prefix; each vlan-* interface (default.nix) carves a /64 out of it
|
||||
# via DHCPPrefixDelegation and announces it to clients with SLAAC.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.cnx.router;
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
systemd.network.networks."45-ppp0" = {
|
||||
matchConfig.Name = "ppp0";
|
||||
networkConfig = {
|
||||
DHCP = "ipv6";
|
||||
# pppd owns the v4 address/route on this link; don't let networkd
|
||||
# tear them down.
|
||||
KeepConfiguration = "static";
|
||||
# Default v6 route comes from the ISP's RA when they send one.
|
||||
IPv6AcceptRA = true;
|
||||
};
|
||||
# Many PPPoE ISPs never send an RA with the M flag; solicit regardless.
|
||||
dhcpV6Config.WithoutRA = "solicit";
|
||||
linkConfig.RequiredForOnline = "no";
|
||||
};
|
||||
|
||||
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = lib.mkDefault 1;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
# TP-Link Omada SDN controller for sites with Omada APs/switches. There is no
|
||||
# nixpkgs package, so it runs as a podman container (mbentley/omada-controller,
|
||||
# the de-facto standard image). Host networking because device adoption relies
|
||||
# on L2 broadcast discovery (UDP 29810) on the mgmt VLAN; the default-deny
|
||||
# input firewall keeps its ports unreachable from WAN and non-mgmt VLANs.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.cnx.router;
|
||||
mesh = import ../mesh-hosts.nix { inherit config lib; };
|
||||
in
|
||||
{
|
||||
options.cnx.router.omada.enable =
|
||||
lib.mkEnableOption "TP-Link Omada SDN controller (podman container)";
|
||||
|
||||
config = lib.mkIf (cfg.enable && cfg.omada.enable) {
|
||||
virtualisation.podman.enable = true;
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
containers.omada = {
|
||||
image = "docker.io/mbentley/omada-controller:5.15";
|
||||
extraOptions = [ "--network=host" ];
|
||||
environment.TZ = config.time.timeZone;
|
||||
volumes = [
|
||||
"/var/lib/omada/data:/opt/tplink/EAPController/data"
|
||||
"/var/lib/omada/logs:/opt/tplink/EAPController/logs"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# Admin UI (8043) also reachable over the mesh, like Grafana on control.
|
||||
networking.firewall.extraInputRules = ''
|
||||
ip6 saddr ${mesh.subnet} tcp dport 8043 accept comment "omada ui over the mesh"
|
||||
'';
|
||||
|
||||
# Controller state (adopted devices, site config, cert) — declared as clan
|
||||
# state so a borgbackup client can pick it up; backup wiring is a later step.
|
||||
clan.core.state.omada.folders = [ "/var/lib/omada" ];
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,64 @@
|
||||
# PPPoE WAN session. ISP credentials are entered once at `clan vars generate`
|
||||
# (prompts). Both are secret — AIS often uses the same string for username and
|
||||
# password — so neither may land in the Nix store: pppd reads the username from
|
||||
# an included secret options file and the password from chap/pap-secrets.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.cnx.router;
|
||||
creds = config.clan.core.vars.generators.pppoe-credentials;
|
||||
in
|
||||
{
|
||||
config = lib.mkIf cfg.enable {
|
||||
clan.core.vars.generators.pppoe-credentials = {
|
||||
prompts.username = {
|
||||
description = "PPPoE username (from the ISP)";
|
||||
type = "hidden";
|
||||
};
|
||||
prompts.password = {
|
||||
description = "PPPoE password (from the ISP)";
|
||||
type = "hidden";
|
||||
};
|
||||
files."user-opts".secret = true;
|
||||
files."chap-secrets".secret = true;
|
||||
script = ''
|
||||
user="$(cat "$prompts"/username)"
|
||||
pass="$(cat "$prompts"/password)"
|
||||
printf 'user "%s"\n' "$user" > "$out"/user-opts
|
||||
printf '"%s" * "%s"\n' "$user" "$pass" > "$out"/chap-secrets
|
||||
'';
|
||||
};
|
||||
|
||||
services.pppd = {
|
||||
enable = true;
|
||||
peers.wan = {
|
||||
autostart = true;
|
||||
config = ''
|
||||
plugin pppoe.so ${cfg.wan.pppInterface}
|
||||
ifname ppp0
|
||||
file ${creds.files."user-opts".path}
|
||||
noipdefault
|
||||
defaultroute
|
||||
noauth
|
||||
hide-password
|
||||
persist
|
||||
maxfail 0
|
||||
holdoff 5
|
||||
lcp-echo-interval 15
|
||||
lcp-echo-failure 3
|
||||
+ipv6
|
||||
mtu 1492
|
||||
mru 1492
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# pppd looks up the password for `user` in these files at dial time; both
|
||||
# point at the same generated `"<user>" * "<pass>"` line (PAP and CHAP).
|
||||
environment.etc."ppp/chap-secrets".source = creds.files."chap-secrets".path;
|
||||
environment.etc."ppp/pap-secrets".source = creds.files."chap-secrets".path;
|
||||
};
|
||||
}
|
||||
Executable
+6
@@ -0,0 +1,6 @@
|
||||
[
|
||||
{
|
||||
"publickey": "age1g8a6fqhqg8q8qu4jyuhxc7hf00t5qvra55chyfm0qk45wlmvc9qs2cft8t",
|
||||
"type": "age"
|
||||
}
|
||||
]
|
||||
@@ -0,0 +1,14 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:bsb98446kjvnDAVWNIqvH64uD6XyfEpohPFZs38jDaxxTp1wqJmFdeDW+p3SGld8Q+4h6rq7rFtTUJnQyslvgsPfYN5tBhJuTbI=,iv:pPUf3RgHqS8LlRIBdZ7jmzxp5VmlP68nrX8TCVP8aGU=,tag:SseZa3Sf5LuMXWN8CNSbxw==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBcC92dDND\nUFFiMGYzSE5zWFdoRXlSV1lQdHc4TDBab21wSWpxMGxsSDVweQplTW5lcUY3dXdR\nMUJPamMzREZlN0N6WTVUbE9kaXlZMVVDUFBRVnU5TkJjCi0tLSBzZW5SYXMrRTlT\nYmJLSDRlWTg5bFdNRmw1WkhpQVQ5Zi9GeG91SUtxM3RVClP9r+sAX8BVngpVGPJh\n/tYHqmSl67sFL5K6TJog1QQ1Gj2GiiTXE/kLTN+vsPbQaepqXamCKNrMXZWYOA2t\ntWw=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T09:03:13Z",
|
||||
"mac": "ENC[AES256_GCM,data:MKIyykYwtQqpUnXqZQKzKwoRhSon2PH0wYiTDTvogaVREHfpEPs/mdOjQBUHtbr1QGqWNh4AxdBTKfpjXTlncHAEtcIdVH3qPccVxsXqfqRmZPDFzcHZAIw+VSvDsKwD3anixiXDeHmeLawwbyb1rnS0P8KquXbmjvirwGUIQLU=,iv:+hdLXMJMCby/6Q6JGxp4p95GgPKbdA/OTAZloyylr08=,tag:ZZ4dKjhjpE2xqcoNf4qeoA==,type:str]",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
9a9e2f23526941b204dacfe8fc77dad5f4b1c7aff945cdbf301ec61129959228
|
||||
@@ -0,0 +1 @@
|
||||
ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIHiQTWR/pRz9vlrtQSe+u2g8XPDZvFpRBCpF7bQ6mBPaAAAAIH+Ix/XbsbqHU87Kg7Y9frnhYgfUEMNKOmQ3DSlb9LCmAAAAAAAAAAAAAAACAAAAB2NvbnRyb2wAAAAgAAAAHGNvbnRyb2wuY254LW5ldHdvcmsuaW50ZXJuYWwAAAAAAAAAAP//////////AAAAAAAAAAAAAAAAAAAAMwAAAAtzc2gtZWQyNTUxOQAAACCboWwGkseX7mqk2GVtM2o1WPRzh8U3X6A3woanYG9xoQAAAFMAAAALc3NoLWVkMjU1MTkAAABAbWgsXjGd/QGdbYHNfHs4LiMgF1weHHirWk4ZLMuTLRDXObwdJ4tbc9IGDfNBZnAfOSxBBy+U/sjGbKQtRWt4Aw== /tmp/vars-irrhty3h/in/openssh/ssh.id_ed25519.pub
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
+1
@@ -0,0 +1 @@
|
||||
../../../../../../sops/machines/control
|
||||
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:r0i0hSQpZQfTP/2VhM7DkFAits86qDRlowbnwZqs4JrtvNjmReJe/mkF8xPT4eKusIzB/THAY4udgltrrOP0iFRMBPQqeFsd0w==,iv:+oYEln5OVeaFujy22IGKxKEgsExw0pSK3+bYQ82riPI=,tag:/FP5zwVfUszr3oAv6nwyVA==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWSkthdHhQMHJ5THMxNUdS\nTGRZUVFDMEd6OVBPWFN3bXVzcFNnT0lrR1hrCkZ2bVRvVnJlM3BLc0ZqNUUwQ1VD\nMlJ1bmpkdzVYYURPOUorNkZKWDk5NGMKLS0tIC80Yy81K2owMDh6SFVMSmNOeERq\nVEJWNFRLV1gxOUx5WWJwWE5uNDR1eTgKdEcfmvFy5E81t2SWWEdPCbQy9nxGsMCT\nsZZxIbGwN0W3pf+QoPtIHl2tAixKy+gHPp8UNTGToDuK6ILSf8OoSQ==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1env5y2eey0p3dggs8tydwmtyhtwqylpg7spuququ4vvax6arzp2qjnm4tx"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjTU8vOVRNbjBNOWpBWWpJ\nTUtIY1g4R1VVb2krNWxDOFpobkhuSmVkTFV3ClA0azFHVzkrY0xJdERZV0tLZkhN\nbldVYjJObjBIZm1RelB5VzBiU3dqK2sKLS0tIEdxRFRJMTI3RzI3ampRYVM2YWJI\nSU1pTWtRWVU2RDRHcmZtaGxhWElwd2sKK1zZtqqkdRMdITSKbJ/JilpAAflkgG5G\nnaeHwBIw75pZa6lQDM2aRWN+yFUMQtbJ3i7Zw/Du+emikyN1+hz5cg==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBdzdqU0M0\nOGNqMHJLZ0V4RHhnclE2SUY0aVFVMjB1azVlUlE5VXBTbGRsTgpFWjNPaDErU0cy\nNFFGR0VIODRTamc0bWxCTFN4MU9CdllaWjhvOUJaeWU4Ci0tLSBlK09xeGpRenk0\nZjlLTkhtR0NZZ1Jna2xHbFpZeUl3aEZ4cndhcHFOQkk0CuX8TF7mW7GowFZ2X75v\ng8zrxp3xtMzPp/C+dbuu02Lfe9f/1jaBOTtJjR6BnV0ucfYjUhtw7OQ3qCUV7a+Z\nG0c=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T10:15:43Z",
|
||||
"mac": "ENC[AES256_GCM,data:uq8xDJBop1yPYMb6gNNWhKxJAiBdMjuYHhA3fvpCauDAakKgEGcSmc7/cnSAtds4NbsPkxi6tn32aJvF8QsKlSIycnqDpxGqpGVgYjvt/lasM50Ukwk6W+YGwTx8bnCmFazimJuaNg92G0VZAGI0uybITR3EEHws/9na69470jc=,iv:hJcVMW1Gaf9Rle5K3LJV/P9Eo7AVBss40rZ5csQml1o=,tag:5ql+BvXOYlgOgbNDl5o/vw==,type:str]",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
@@ -0,0 +1,18 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:TyTbzOZ9AOAaP5e96sleUEuuSq/FPjbfHZ6aeR5iOwvDtoc8ZhLYXEO+AF1p+DKS5hDA,iv:9VgMtKiHt8oYnNY8E9+bodU5ei3riw+Gx2KiOQBhoyk=,tag:zJXsCVITlqqrw72QqE/coQ==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDdWJBOEkwM01BZDlMVS9W\nekFmT0JuMnZHNnBBOVhYK05Ra3VzMW9kK0ZrCkkzRk1JZHdzVlhBeEtTamNHb21x\nU1RkaDZYVEVFV1pyL0lSb1JXeWN6ZDgKLS0tIEVqWDZwZ1RBSS8rVVJLM1pSVkRY\nNEVub1diUytCUHZ1c3NPaWlCUHFYc2MK2lqzBTaw9qIFB6cucfxbMQGhLfSyHYhi\nRJf+pwI0BehAteT87IAbA63Sdx82QNb21mU1AYHPxLdDdrrHWnFxJA==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBOUhYNXIz\nMU9VU3ZMN0NVT1JSZ2N0Q1hxS2dnZm5iY1Z2WUtsaWlXVks0MApxbEtmWWVmQlZ5\nNzZrLy85M1ZiSlc1Y01OM1VEYy9rZ2FhdU5uNTFPa3U0Ci0tLSBkM0ppSUJtMkVP\nWC9jN0NOam9iSy9xakNhOUN3NjBtVllvUU13Tlo4RUdNCtY/2d3ANDMh2Sx1aFlm\n/b3GKbXeeBeeHuFBAsQmuZXqb5EHGJsB9JpjsR0TJJVflCgYYSjn0L1xg9DG/ANa\nn1k=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T10:15:43Z",
|
||||
"mac": "ENC[AES256_GCM,data:hVEI3iNwXa0O9ZkZWzb0OP8tnsTXWB0znLPg6FIx7Z7D9yPSwCpVu4qdtLwFnB6SEk1tnFykQofCKJ+UQtf6AuziGymwONUQWwUW7pF3zoKtxJ4bJQEKAVChgJqKx7GTp5HXxFkbrp03USJqaHqE9M0leRWIamdBeyXI9rdX9OE=,iv:dn4BqTra2ljHmXfoEoVFwRXXtwiLOs3j5fRNbvndIgA=,tag:zOaRMxl23pJRIvJo3ettEg==,type:str]",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
$y$j9T$tSEgEho.KxGPAaQTjU03W1$M6aXoOlLF6B/QaH5XZl/kAGxuC5VClCUpYlr9gOCJt/
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
@@ -0,0 +1,19 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:WtA3B4lfAERXHgc6hyjaBdFxNMlW26VeAYVb6qosXuFGxwqzbf7XXrEWJ0CSFhb5CSJO0SFJ,iv:ATeO9O1uZ3M40Y8q6Udi5qhmGsjSR7GxIRCpGnls8bg=,tag:NKiLATUjXWVJ2SXNI984Ag==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBOWVrRjh2\nZjgxSHdYeUFkRFVLRjc0WVZPNjFoU0wyMnB3cDU3ODJLeU4rQwpxdXRLOWtuMEhx\nR0NROE5xeHdBL1NhQ3NrSlQ5eUE0OGcrcGt6NGdRdTRvCi0tLSA2aDdydHB2TWpR\nQ09kakg3V09iNHpvdVYxck9DeVgwMFhMZ2g5cUxyWXo0CleMojWF4rB5GlAAM1D1\nKEES65mAa/3GPM0vHhd/YBwwyzyv4HeZHSVao5O10FzMWc226Rc029nhNwcTAlA7\nphU=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5aFlkMktXRlIxZE8xTXNL\nRzFzWisrQkxEYXJ4STU5VkxZN2d0QjN2V0hrCnZxalRXZno3bk9TUG9oWFhnVkZM\nT3VLK1lLMWNtaHZ3Qk5odm9rRXFRTVEKLS0tIGd2K3ZNZUxoQXROVng0b1c0UU1r\nUWJxWnpCeWxEK3A2SnNBWjAxczZkeWcKOl+DtJQkkKaS1YYaDzqmasnxiY8iEuAd\n57f0zP+peA9Q4U3TZg3UGG94V9kuweNMTWPfj1GZvwBvZP9sZYuFYw==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T09:03:14Z",
|
||||
"mac": "ENC[AES256_GCM,data:8lemWJvcdPy0sg0K+Zn9A7xWd5X4q3XGTb+R5DiJMSo8BWxpP+QGNqxEuni8sNxP2d0bkrsEI3vG89lx37x3iot667Gds0qAaHq7h8l+3iwAvGMXAEzwIms9GLdIcJiUWYlFiAcicfUINWtPQ+adxACFzTOBIBEGqD6iQ5B+KsM=,iv:OuBeq83CopTNeJJM/UHUrI7RKIGVJ3tM+DcckuFxLBc=,tag:JAXpfqwSDRr4e58wiJeMNQ==,type:str]",
|
||||
"unencrypted_suffix": "_unencrypted",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
210641414b2391ee4659814fb67a1869d8f1920716b53f7b5226be36887ec7ce
|
||||
@@ -0,0 +1 @@
|
||||
ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAICg/CnZm/jIFijKdkXTrJS2Fman7vhPtUcpTFVhLAoyLAAAAIP+kt1X3TTJhWQYakYQzrr2lI8tanZ74uEahnD4meuCaAAAAAAAAAAAAAAACAAAACGd3LWNueC0xAAAAIQAAAB1ndy1jbngtMS5jbngtbmV0d29yay5pbnRlcm5hbAAAAAAAAAAA//////////8AAAAAAAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIJuhbAaSx5fuaqTYZW0zajVY9HOHxTdfoDfChqdgb3GhAAAAUwAAAAtzc2gtZWQyNTUxOQAAAEAhM9fTE9iCnV1wGKunJcRqOmNWbu0iZjPqXNcPp8rpwFJm/8CW0qC/TV/H5im7sX68K+ZOOaOTuOqu+D6U+lIA /tmp/vars-gc02c4xe/in/openssh/ssh.id_ed25519.pub
|
||||
@@ -0,0 +1 @@
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP+kt1X3TTJhWQYakYQzrr2lI8tanZ74uEahnD4meuCa
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/machines/gw-cnx-1
|
||||
@@ -0,0 +1,23 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:C+f7BWR2JNfMIqrfCrfkBC6fouAMLFXAEvoltExJU9FkiE8JN+AxtMVEH38PTui9NzlPnmLFc95MGHstj8Kb3rViwuoY2lCHCRM3uHPTau0Cxp8Ekq5ILMebjKLVeeyisQXKelMXg0zYBX+HBUHYJi+SYqQM7Pw3iI1WRStW43PGPjcSExAhgQts8V5xaTjseCf7EqgtjfOmya/uQXe6asL+GVjH8icpc0A9+AyrZci4Vr3lsJ1qgy0ej4a17glfuXnjaXjnlw4vDxDAz0c7xjx88xRxagqtN19Yi0jLRIuLU7Brka9wDMbu6yj6HzaYRaha+4HLDTbg+0Gd+iyH6z0tiXAj7p35VtBRefL/0CW/kIzwyl7GWAZpaX9xPUzZre20TYnPpxToP6n/6SJNccJhNd5GiGYtVzHXj9ni1kulX5N7A9QEikZGyujxPi+LFQVIKnDL1cxS8EeDqiRuAEi5LJa7xYKBXBIFdFO/9DMDesMQcvPP3HjpdFtaaybvpzai,iv:0dUn8InsV5N893LRfJNmYieSFSzPv1ceqXZzwkAmoIw=,tag:0eVSEfOHzD6AcuCDLY+ggw==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBld0NYcG9weENnN1JadG5G\nSFVPQzE1TG1POFc0RFZnSk5PbWZJNWpFY2tjCnBxdWM1R0kvOXUzUCtqUjMxcjMr\nQ2Rsd2d1QWd2bzZxaUN4VTAwdHZPSHcKLS0tIFhWNmZYSzJhR255NFRFa1VBcWtK\nVXF1YTVRVVVMLzVMQ0l2RnJLVDVWVU0KMGbb1Nnw5eEDFpGGi0Y3Dr15J6lyLeKY\n4hQJN4gEYcBokEbAV3wTYbkDQqDuQ1dKfS+zgybA1pomKcubkDCWlQ==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1g8a6fqhqg8q8qu4jyuhxc7hf00t5qvra55chyfm0qk45wlmvc9qs2cft8t"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBK2E4TWdr\nTCttMjFmN1NMRWQ4YmpUZGNWa3NWTkJWUnRJSEthcnJncEhSRgpFTGx5L1VDSVhY\nWE1Udmt5NUkyOHdTd0JqUmlxdGt6UFEyK3RHakNHVklBCi0tLSBVbVFQSWMxdGlj\nTmdSN3Q3NVZaOVRWQk03K1o5WmphMGFFNHUwOGdCcUV3CmqsQ6E3U20tvO0ciXqb\nUIdmcfuy7u4SGQY4qskEefYQrn1TaD/zVM9yL+Uw6GvxxSnKeytgkwxnCTTjh10C\nVB0=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSOWVZT0hRQWJiSG9OcFg3\ndm9rN0ZyZm45MGE1bDJ0N3dFWi9BV0R2WGhNClY1MmZsSWxESFljM3FQTFlkSlha\nenF2QkRmU3VSTWNqOG5qeEU4TXA5U3MKLS0tIENlNXpvRHJIQk83Q3ZIV24rdGU0\nWFB5NllWTU1ldUtNWmNGN21XMXBYZGsKhlAkMshZJjY48PBgAd8W7JAISnC/BGjL\n4sZez/+Qnz06y/ZyvatV3yIDmUTvp2jSqFzvwvDBeHuuAowpa6Yg4w==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T09:03:14Z",
|
||||
"mac": "ENC[AES256_GCM,data:07tbbE0nqs0P0svDnzg5f6bPklOjTVFLGIsDc+ozllTU3VLYWHwvvkdgoJbPDaFH5mXykK6JyMZiI5jorx8iG/0+3s1bVMR0lCom7cXOqzai/h5meFZ8ymkON0cVXqTfwy7QTAlxg7ysjAqHLvJlHorTNFVUjxZelfDapa4g/ew=,iv:0SdRCRUcD+QxSZdOrzJ6Ri3eK1rvysFWDOrxSNc/5B8=,tag:c6R5gzhvlaBOl+J8zNjiOw==,type:str]",
|
||||
"unencrypted_suffix": "_unencrypted",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/machines/gw-cnx-1
|
||||
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:KEymUXwLPa5F2Y2W3LHGKnzGwmekRR/Wjs0aIg==,iv:g8LUbeDkjavPuo9zeEgJaWt9WOMTFXjAoZH6freFzHA=,tag:JiJRR5lOMTiBNxnnByv1dw==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5RHZqdkUvK0MyWkg3L2RK\nbjE2ZGdsSGRrYTRtRW1uQlRsVExCS2FkdEd3CkpkTGl6TTZndGRPRDh0VmRuTzk3\nZmdWUEJqSTdIZUEwQzJqM3QwOW1VS0EKLS0tIFU0QWx0d3h5c2F1U21qUzRMMExS\nbTFTc2lEWDVQSHZFYURxaEcyQTloQTAK6yIaBPEVqj3nlvsIl3srGWm9o6a9aE91\nZelv3QXjKUE1yQlrStZPKFNo4cZN/bt/81IEZIKcASE/b2DOJWW+ag==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1g8a6fqhqg8q8qu4jyuhxc7hf00t5qvra55chyfm0qk45wlmvc9qs2cft8t"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIOTFQTWxlWkFXTXUyczIw\nV1U0RXBya3FiUXdrQzRLcWNCVG1lM1hobjFvCmZLcS9VTmJORDN2U0JjUFJnTGNx\nWW5BQzNRUlU2UTlTNVFsaGFwWldBYkEKLS0tIDhkTEk4dlllYms4WVM5dmhlcTZW\neE5tUzl1RVRjOTV0c0tRSmYvWlVyYlkKRCoMiXvMWSeZpgbI8xZ3FoioZjzCPHhW\nGQhcl3oTicZfyhSsDn51Y4GGHQJxCoRJFVs1jw2/R/V+q3/rUEwjXw==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBdjRpYm9L\nd25aTjJKdkJxbnErVU5Wb2dBbjdkaTZ0YmcyOUR1OEhIR1REYQo1WENYcjQrSXJJ\nM0c2Zldpd1ByYUxmNE9vOFRNclZZQk1uT0Y1SWlyQTB3Ci0tLSBSOXd4MDRYNHlI\nZUdGajVmTjU1aXJLNXpLS0docS9GZUZlSng0aVpaeW1rCkLpdGashC/Dmvjp2nOb\n3oH8GROhquOXPBJemxH4Xr3sZE4NzO5UdAf5ErBMLgmLCKEOM3A+DXOffGyHVPBf\ndZY=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T09:34:28Z",
|
||||
"mac": "ENC[AES256_GCM,data:/cKylOQQRWKIoKwOlL/SBe/cPWyIFixUDfeh/KOIHOSdJFa6dcV78IHZgiy+aNF4ogjX+y5cy1TXsUFiagFiBRpsO9IOLj6NhSWp8ox2q0vwj0Vjk5RF+SmASLSREuGe7MvsNwwesEkbvOpRE2PAJer518EGk9EvFwjUWE5Y7z8=,iv:GuHbdaf9hq0XBhniVsYZcfo9WstOQJM1UGbd9Gcsmgk=,tag:bZQiL2NJA6R254KAcajfgQ==,type:str]",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/machines/gw-cnx-1
|
||||
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:mmdooyUC9Kh7y64dTTBn1wtT,iv:syGCZO3EzGXKiBe/gudF93dc6oJz0wWxqpbd4UX2hcU=,tag:L1EzmPnx5B/vGscoKYYjeQ==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaaXV3amcxV3M2dEFOLzhO\nV2prS0ZsbC9OYmg5TU5CbThDd3p5TGNGL0JVCnNMMkI5NU02a0RNZDdqcVUwRXVQ\nQURQOVB2MTg5QzJjeVpoZmJnUk93WncKLS0tIGJHOHdqVmRBQTJDMjdCWFFOeVkw\nekdEb2x5a0NseityMFVWeWFLckZsK2sKstOfMyYSgw2+DELgzHZl6GY5S0Ph45Jv\nTLQlyRPUd1IqvLVtmQOieUB+9e5k9TUTfLdvxUxIqSNKxcxVnJ7nsw==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1g8a6fqhqg8q8qu4jyuhxc7hf00t5qvra55chyfm0qk45wlmvc9qs2cft8t"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByL0x4bHJNNVZPTEttK3A0\nNEc4Q2RQU09nWkFVQmxCL0NPem04ODNOY2l3ClJ0UTE4VEd0ZWNWSjdrbVhqcEF6\nbUYzQUFIeFJvT2QxMU8xNDlROE5WQ1EKLS0tIFlJSUR4NTBUSUFseUVNUk8wTkVi\nS29YWVJTM1o4VG01Y3pYSFBUb3dkQk0KM1VGs6ZIMO7/uj8aoLScsRevwhDBgWiW\nCLfEllrjicWomfjHBUBFeRKqKhvI9eWtBi64gNL+d+DUZ4NMx3fDyg==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBeFM0UDJU\nTytwOE82QUV5RjNaYkVaWDJhTDQxTWRoUzJ6VjN5R0tWa1phdgpUVCtsWW1paE4v\nMmdSbTZvbURaZUcwb3U3OXRMdXZLRHFXS1NPZmlZY3pJCi0tLSBYMysydUFORmJi\nbHVrU1BtaFBRNCtLYjRRVndjZGR4R1hYdHZicnNDQlg0CkTyVvREnp/73rMF7XOq\nsvP1jr09gIy5o3URUcv+IanFLkiBCZciyMoTnOJKJOwWlf+1SXBAKO86hUrgOvW2\nYOM=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T09:34:28Z",
|
||||
"mac": "ENC[AES256_GCM,data:EIGsqX6qnOocm0pxEZAsZf6tprPst88csaAIX0PnbgJSkO7DlYT6dC9tXeTtGSujkolAhLG9fB5FGfT1hCFMzHzgZCUbPaT9tei8X74XwC7nABqc5mSjQDS4vUGpoToH33yu3UStFQGVstOEG+FSjQpiY2fFKVJ+8u+Y2EcghDA=,iv:E56Tu6Fihtaj+NlZw8EQ3sam7SxRjPPZ/KgFjzBu4DE=,tag:hR5o2f/Jrigtp+Zjm695KA==,type:str]",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
8804124153
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/machines/gw-cnx-1
|
||||
@@ -0,0 +1,23 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:HxPAe9vXu18iI/mvwCGgQFgcZjOdzUwNlwel/89e4eFD3RUQX3RaD+Vb3HylYQ/Y/gahdWM9NYBoOf/fOMTzXFN+D/VkQHrKXw==,iv:u6NuNha/Z60x5ig11O/S1mAO+P74u7vFvjhxR17KRE4=,tag:4ae0Si08BiHFMDNKRMLRTg==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBL0QzY2lq\nU3NqRGY0dVpRZWtxRWhmNmZvd0FaSElBekl6UmdXVkkyeXp6RwpSamdORnluMlhK\nOEJ2OGNCZUh6Z1VjTHJoMytoOC9vcGFBMmtIVHlPRSt3Ci0tLSBxR1BCNy95NlZy\nek55bSs5OXRrSkdCWmpqVzFWMmtVTVd2a1NqNWh4MlhRCktog39bvtPgDWcSNLGr\nL36h37Q0h4/dYO1enkre0v7UvgVDjC0FmP5jQEUl1YEtCIvOSsSTPHYvzuQ5JUJB\nd5I=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3L1RPcHlZbXQxMEh3WEFP\nRGhEYWhwRVhQTk5XM1N5NXZTMjh6cTErYWo4CkliZWcvZzVXNEhlaTgvTFpVc1M3\nNGdETDEyS1JlZnZ5eStQOHdhYTh0aE0KLS0tIG9mQ2hQaWR6dTUyRmNob0p3bE9R\nYmZwZGZ6TDZGdEtsTUVUMHdQOVMxbE0Ko48BMimAX8Zu5o0lUeJcpm/1G0Ed/P07\nOVVc5hHIQJCmgUOVvYQvA1uHdzfFOl4jChjwk7bejDXGoOrNwht57Q==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1g8a6fqhqg8q8qu4jyuhxc7hf00t5qvra55chyfm0qk45wlmvc9qs2cft8t"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4WEFHNmg1SmhqOVkzbkpl\nUnpZZkNHMTcrMklzSGo3RkhzSG9sK3Njb25VCjgvb2NzeDJNKytXQ2RGRHRsRmM4\nZUw5RlRsblRaZ3Y5d052QnlGT3cxbzQKLS0tIFlQZ1FHSlUwM1FpOVNxK3dIK0h0\nVTFTQzhCRHcyc0NzNTFlbGF6TzN1MVUKTCUyyPE0YxTYEwORmK6c/wWuCvia3oJL\nWOTR149gsMpPfgaUqU5ncPyqgkR6fEF1T+iqaVdwOXuBPZJ8qlYCtQ==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T09:03:15Z",
|
||||
"mac": "ENC[AES256_GCM,data:qPfMhfrfjpvZGqyrhDuudG6+GmGWThZD3sTAal/9E0x98FPg3GrJbD1UCmr2nWXltkrPDpBRZPfRjUzSKUEtH7Sy2mZ8m4mZgQTeS1wLUe6/oaid/zz9vRNbNXZS+UregW+6Xd1qWwfuZ/rcciNyR/ijRMj4Mm434ZvsuMirzgw=,iv:wT2TJ/ZwgvpmjHEkDOj5hrBO30IgbPcQ/yle06V4/8E=,tag:BkH1Blt9Mg73PjK3zpchRQ==,type:str]",
|
||||
"unencrypted_suffix": "_unencrypted",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
@@ -0,0 +1,19 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:Yr5kdmNaa42lDVwyTx/C7fKgluBKMBijLTO20y7mH8G+xsn1eQd+/fNl+FJks3QYiiE=,iv:FyZ7lLikZwxBo6V7gbGg0HX6/ljtowNX8M8H7K1/9nI=,tag:6N61vAWpayMPDojAfZvmOg==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBbm1RcUI3\nWmRFSEdwSmRCamNKM2JNczN2Um9mUFhxMEk1dW95anpTZXNQNApETGtVUmFWTGZs\nNHpMTU5XUXhUN2lSQ0dIYXpMemFmVFhTLytyL1R2UWM0Ci0tLSBqWlkzMVJ2ODZp\nRTZBbjFxWUhRQkdNNktrRVpER0NEN3ZIY1RBVVllckl3CrQGPl5f4kv5Mt9omQ3A\niu9izVDlqt6H+knUpPBjEvCz3lJ6wE43V1513X7pabYese0WsBQY/PK8qBJpug2M\nro0=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoWkxHaXFkOTBTVG9GTDYy\nV3NXNGttN2ovazMvUzNsU2hiaEcvUFNQZG1ZCmFiZVV5M09LNkc4QW5JOGQyQ3Fj\nejdNTjVrU2tZb2FpaEFJYklzZXhEWDAKLS0tIHZITnBuU093Wks1YTBUNnZkR1NF\ncFJWSzFqQW1CVWJCb3o5ZFZRR3RLZjgKsxstaYtfL4WA/WlkOmSq/5YT8Zu83iMG\nTQCNHCvHvwprtmRfeUe0x1wUXqynVPRRcxbQCi5KiHh5zZR2d73Dsg==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T09:03:15Z",
|
||||
"mac": "ENC[AES256_GCM,data:A9lKOiRMDamC3QXSpRhS1x+xefOkk7ONCGG338dQ4J6tFRBKS8sJvMA/DlHxucCAKaWA6y8fcEf6k1Q0z+469OolrIAphG8TKYEKvOd7X5isvz/u6zXpwafV19mrHDcPB2WFGHM1g0A7wfSVzHnvwJ2vlcSfh/PYLiir1MbD+G4=,iv:C84tv9oUZ5uxg1ivfkCXgCamtl16UhPEVJ3OFIrAZQ0=,tag:cRT/RGqpvyzt3GHUYM9kuQ==,type:str]",
|
||||
"unencrypted_suffix": "_unencrypted",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
26.05
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/machines/gw-cnx-1
|
||||
@@ -0,0 +1,23 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:mXJtT9SvhkiJq5R1kONHBGCuAXaJb8fDrkDZxNw0uu7DFaYAzuhTd6OvjHj9dljgnZDQjAVBPDj3ykZNVvAv,iv:bGGww3Dx94EeTFRVXkT8mK/a+Ai961aM0Po0QxEUgr8=,tag:0loC/c+GoT6my1ESs+3Bnw==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBdEtaRHh6\nN0RaNVpudDBYYk9iRG9QNGt0NHNuNlowNk5LbHZLSm9FOXByMgpiMHlRdGRnTjI1\nbUt4YWxDdGtjUnd5L2R2dnlCN3o2bUtzOTc2WWh1WVlRCi0tLSBWMjIyS3VhMkRm\nT0lkdldwVC93QzdMc0taZWRqZmJIaFFFSkx1Nnh0K0U0CidB2Un7vuPdC4+sX6q6\n+rCmDpFbPqWy+AENgrOdXlRnAcXH7dBWmgLGt85l6XtxAjIUAS9euWlLRkO0OpUY\nc7c=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjalVSdlRvRFkvZkcwekR4\nOXF6MkczUWNSSTVFcFB6OWVBQ3MzemNqaFcwCmVKRUdxbldUY0JRQW0yR1MxeEJs\nejVRVmVyYUN4QUlJWjc4ZDRrTmZBK1kKLS0tIHU5RldrckFGbzNOWGZRaFB4cURs\nQUtuRC83MERUeTB6RFRRQVE0SnNCRUUKMh4JmS5Tv3Yluw2HtFSdnjp0rJHb+Pm9\njgWcRxX1a7/qxGaYDEKFJ30RW5O2xebiyE3f77YZUmfmfw0/qRUvmA==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1YkllWEhjSStBSnU5eGcz\nQU9XRWVQOTg1Q29hK0pGd3RwNUhkUXFDd0RJCnE2TkduNkIwaDdYdjQwVVRpQ3lz\nWDVMaW9JZ085YTFtQjNhN3REK0t2MFEKLS0tIEVZYU5iWk9IV0JYYnhPK2UrcVps\nTk9qR0pqYmtXSnZmVDMvR1lVQXc2YWsKUBXa610I4RKHAUXrr3GOyHlnzOtxPxdW\n4+UgXK5ByrwqV5Ul+JKCmU2WpfcRYJlGVGGNcA1r37Df9QFRezgw0g==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1g8a6fqhqg8q8qu4jyuhxc7hf00t5qvra55chyfm0qk45wlmvc9qs2cft8t"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T09:03:17Z",
|
||||
"mac": "ENC[AES256_GCM,data:dEk6VblChVD9XtqnMWOCuzXtpF1kMJ4KNO8E/xxo6SxvIdR0FwjaPrL3B5mRKJRLX9IdehqfeDVfZykCS4oSfog6AGKCl+FtDu7lXZwJfV3JpM59VuaI48H0u1lMupw0jR6nkd6wAvwqXAGM/KKMD9cKs83WbSbp8wpow/Ejk38=,iv:QqTPg0n53MeMF5oI39jf4KKg5AkZuPeEqNrFpWhXdkI=,tag:hjX+wFgSRAbSWvMnxLXrGQ==,type:str]",
|
||||
"unencrypted_suffix": "_unencrypted",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/machines/gw-cnx-1
|
||||
@@ -0,0 +1,23 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:UH44nJ+3zH5HyXGDvH3SLBL2kUPcAZ5eLjXZ9lFQvvvYTMs/eTq2VsBmaxOyBYs97zzGbk/EFY5MpGPrYL4kYyce+8nYRAlzwazXmIIilZVjpGkAKyLCzWvQUUhkDOUY,iv:e7sH5RfpRUThCl5QlZzoJH5+V0uikARNBdNJ7PCc3m4=,tag:vEQHtyZ8rhifXWO4O73xLg==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBclR5YnZT\nQUZTMnV6Y2hJZW40V1hxMUhkclVtK0E5TVVvOEVjeFB1aHF2ZwpSYmRrME5hb0p4\nSG1YTDJ5N1VLVzYzYmJPNVBvSTJtV29KU0FVRDFXTUk4Ci0tLSBUdnJWa1BtUjBJ\naGpuc2hNZGJydk9rc2ZEQWFnUkpaQ3ZEWWNVUXJIUmtZCjn49OtidX03qZT9Goe8\nWUobnO6o6zbz0Sn4G4bXbLcxunapI9IlCLRtAlPfD3D6DZWYqR+C8Jua2GnlUX/q\nHn0=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBibXB0OVVmZldIS0JITE9k\nNCtrL2llY0cyOXZCKzREWFU3azZydFNxS0hnCjFwa1ZDOGV0bGpMUWtraG9wUFM4\nUGJXVmpTVUJKRDgzZnJkZld3YlppMXMKLS0tIE9Xei9BUE55Z3hzcTNZa3M5TmNi\ncm5lNE82RkUrYytOTzVXMGVTUVUwdTAKievevNumIned89qb2ox9dPs69lxpLwDx\n1orikXSjVGr/gEZcsyx7B2+m3OoiZFwM94neJz9ckmprNmTHuW3K0Q==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzRlFPRXFrQll6cUhGekRq\nbWhidGt2Ykl4T1NrYWVZcVZvMUhPS1hmYXhRCk5VcER5QWhqRFMvcVBKazhpMkF5\nTS9UU21nZlRVYVhJeUI1dFZFRk5mMGsKLS0tIHhidU5Id2JrOHdpZ1V4NkU3T29x\nb1FMM3NudUxPVlYrYVYvU2p2emtITU0KDcf+hNrvRkRmtEZWQx2MNzDFbwQQS/PS\nBmTs1phNbmZ2H3ZwpgTFWgQVjbfH6CzBt5hXS/K4RRr69C3tnHlwhA==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1g8a6fqhqg8q8qu4jyuhxc7hf00t5qvra55chyfm0qk45wlmvc9qs2cft8t"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T09:03:18Z",
|
||||
"mac": "ENC[AES256_GCM,data:z/wf3LsHRJ9ayCiLIkBnNDJaQ+GX0XokWQcBBFA+F8QZ832THVvEmJ9yWzmSXK7GB/LXOwVTyMX30ezSBOutJcySaLPJ5ebFnhyyKW2khU8qdXFVvbeb55K14yZcm+dFyiUkpqDtj5tk20GZD8aunKjmGy+J8UtURynr5pYIR4c=,iv:4+gquB+HkbVeJgSQCXpb2tAACzzAkJfOFKD7hexU5Lc=,tag:/2E7DCrBhoLFYbMF1EcUBg==,type:str]",
|
||||
"unencrypted_suffix": "_unencrypted",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
+1
@@ -0,0 +1 @@
|
||||
../../../../../../sops/machines/gw-cnx-1
|
||||
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:o8lBgZVy0lcXhXgLzpklYbB0zkFuiAM6eYg2Kx1j4mVcslsVtmNp+fXjh/CR0djDVjs58j0YxSW2ubM8PiSwZMxsMxWTFBKZwg==,iv:5YBcsmfDZ1+D5Q87p1xlQyOsF8x6BFYfJi4nkATiKv0=,tag:YO21I3RQW57iN+aFm5PpXA==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqYmhLM2xJUENKRlpRVHVu\nd3pMeStxYWlkVTlYeEFlQk52K3hqc0VRZVJNClVIbnkyY1RnSU5TOFVrMVVrekRX\nWE1IaVJ6eGxWS282NEVvQkYwbHB2ZEUKLS0tIEp3eldaNkRQTzNrOThRc0FVWlZS\nNmplR2tUeXNVRHVNMXRCeHNEdHpvR3cKR7bS4YFvEUM8hgcPR/N3wz0WSZaZbOfK\nsM/naGpy/lKdxufOmrHU5WaesBIMK8s6e07FWL3vgGDoycZrnKbZUg==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1g8a6fqhqg8q8qu4jyuhxc7hf00t5qvra55chyfm0qk45wlmvc9qs2cft8t"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKUEtEWmt6cjBEekgydm5M\nMzg0WFdrbjFQR1JOcmtxbkZMMlNLdVRKZmh3CkNVK0V2dndPUHlMZE53b1k4b3p2\nUVp0OWJrU0hWVW9SbUh2aEZ2aHBidDgKLS0tIGFjNGFuQWpDdmRKNDg0ZElLeXB3\nZFZZTlNLSE1VVEhRY2dSVFhSS28zZ2sKYwvkbwSy56N4sedQAkOZOCHkYjfqlOMv\n2HOCDPxS6gtWqFaJ4LLDyEcWUbJMlx/hvbrI4AI/fzqMsXlZ+MNwRw==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBcGFOamdJ\na1R6dHNVYmY4cE5YSTVBM1NCckhnTy9DaWNEWXFyK0dwRWgwMApkdlVpbCtIWlRr\nUTlUUzZCWnplL25KaU92M2pPWlNUVlNmM003SitGajhzCi0tLSBvRms1MG1BdEw3\ncWpYVlorUk5FemtTSVNkSnNNN1U2YTBiczhONUtxdnMwCllrHDvB9cUxh5V+eDHE\n5hCWb/xr2xvQj5e6jQvlq2KQm9ZLtIdKlLckeGHNowlMHs/rmsKSF0LdFhTU/5BM\nPuw=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T10:15:44Z",
|
||||
"mac": "ENC[AES256_GCM,data:wn1vo4qYXs4BknTsRVhO13k3Pn+IMOWJ5dZsbKXGOME1bOHFIJo6KQkBAMFm9z6YboHvW4gFJgKmzeqOyPtQYLPDmwTE7vYwdlPwERwFHkEp21n75Qm6gMZU7IDRcL+ndVmU65vflscAtBM7EkjZ3N5C0S5ShOCgaoisexKUFEE=,iv:D2Nugo4IuaZxqs+mHzp0opxgsm1VlOSUvw79OXhnMvI=,tag:sIQs5ORYx3hxPLnMIjqkOw==,type:str]",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
@@ -0,0 +1,18 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:6ViETqNUeQL7XaLEQfJDove2uEJwct+KVRMos25qP5wl5XjW/23AUgVmXoBF6DbA,iv:lhZNPf5IXvcaDrYapXk0SqPx7oFv6iS13lAog/l/AEs=,tag:TkmUSNegrpuPXLIru6js6g==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzd290UTgwUnJ4TkpOcGFD\nTE9jZzl2ZkdObndtaEdLZWlLQjJGMWJ1Z1VRClh4UHp4Ny9zN0t0T3g1bXdOcDJI\nbXJYQlFySElrYkRXVlpxZlRoTFJLNEkKLS0tIGNxZlFiUkwzN3o5enlMeklwbTF0\nb1BCS04vK0xsK1FMeG80SjRVTnBLRUUKSL4y1C+x3RKNU/6wyoHtX8dWjOUZf+d4\nZt2xjpX3jY04HtHS6xsWljhz7USMb9m9+n67IdKh9CLeh892iII3ww==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBcmVyejhK\nbURGbkxpQTZDMXNjYzUvbHI5OVJSRi9wYVZrdkRGSVBONTRWNgpxYmh0Y2xsVGt3\nRlR5c0FRRzhUb2l4bmV2ZTl0VGlxYkI0NGx4WlhiSzB3Ci0tLSBoQUxkMmcyQmJ5\nMGkvZXhnbTdRSUE2NGFFYzkzSktqNVZnUU0wRklRS3Y0ChYI6yBNFPgVplfs1W0Y\n+NhEvvebTS/bz/Lw1+HOFBs9u00wIHO0iEgOVQ3TjV0DtT4qWPcbVTc8jzA4Lslj\nf0E=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T10:15:44Z",
|
||||
"mac": "ENC[AES256_GCM,data:T0R1BeWWbsdV9rxdEQfyRdU06z6iUoSeVXqj1TfbB2Ru2Hmi94h1JuyWbNTqjW3YK/ZCj43w1FeDlhLrkzH2U3pFOCUTl1oxmvKK8CYl7rU4ar/zKzH9lEtH94jYN5xnFM+gFd0EYsWxexOaSKyNA66dPRgzU9osV16eDRK02ek=,iv:SyCC54qtwLEUEc6ednIB3HXYOV9M4AooQcaoo35atgY=,tag:uh/TU8RpVVHCGWCX/cAg0A==,type:str]",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
2c8dc9428a80f02d5cd423bcbeaab679fa67a3b1750fe1c46aedac278702225a
|
||||
@@ -0,0 +1 @@
|
||||
ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAICz2IIGaQdGxn84xIpcT+gs5eC9f1G4wbgrWq7+v1+DSAAAAIJJWavBJ7+x+VjALDd1UzkAnYkNiHgrkIzzvwT6ZQX4kAAAAAAAAAAAAAAACAAAAA214MQAAABwAAAAYbXgxLmNueC1uZXR3b3JrLmludGVybmFsAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgm6FsBpLHl+5qpNhlbTNqNVj0c4fFN1+gN8KGp2BvcaEAAABTAAAAC3NzaC1lZDI1NTE5AAAAQMam4pguKWW5h5EGTa2cbr2U+p85LuuT00lAYbf9nf+XIBI/My9SvncPmgQPzdsOotxc15jHFGxPWklNcwh/fwc= /tmp/vars-35cvzbne/in/openssh/ssh.id_ed25519.pub
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/machines/mx1
|
||||
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:hQ95Ee3ZhNIRlPm7tb8+PxJpoNqxSxiqs3Xv8ppNIxEezDTgPyKfa7nOL6eUPzW8XyDv1rYRVzKByLazElXsAwovFjnl6RCOaw==,iv:/ZRpU1uy9w6Iq7QmSFPtmRWCKM+mB7YmsSNPYG7fPVs=,tag:LxcI0P97afIpudiWAUTtvA==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQMTVCeE9mWTRyTk9PVElC\nNk9uTm1NUTRJWTR6YkxLdlBhWXlMVllxemdJClZnS3RtMnVDT1NpRktEdWtqemND\ncWNvOStKN2t6WkhCMHRDZFgwdFh1REEKLS0tIFI5UVcvWnBseHhQWkhXR3hnb0JO\nSHlUd3JUcEVBcjg3cUVMUWM5UVQ1N2sKQ3sPgMucdVNNPUlqV9AxhNhwMggEvs2V\n5BwqBwGOwUbHTDr87pULYtfmuu7uQDMDwQpvG9PnyNV/kODUuWMcMw==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBbEVaTzBEWGM3RDBQQ3Jz\nck1pYjJ6eGlJWENOenB4Rk0yNnNHYlZ1RDJVCm1CT1kvVWhrVWxwdkladjRBNWVG\ndjNWZlk3UldaRmxYMGg5K3ZwNE02WlEKLS0tIDgvMG5ZS05jb2taWEthbVVoVkhH\nQk9nWVBtSFd0QkJRYzFpc1FvTGR5eTQKH6+XrJcfScSJ4COHp7EWR2haiKF8fqIa\nJLFTgK0LNTYW2PYtxR35CkSZHe0G8iiGdg3c8yLkhf00HfiCH9oFww==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1l5hw95p5h4sthrgn0usms9yfkwwmcvv34tjgrtv9s4e6x39chacshgxavs"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBNXg2NTlH\nWEJCaE5BR2tQQ3Nkd0RYSVlueDhIN1RTZkxSNHc5Q1JKdHkvWgpFY1l5M1NjT21S\nY2hoNnNRa3F2RWg2bUVvS0hPbFBPYXU0N0VFaEx6RGpZCi0tLSB2U0xmVnNtMWdm\nakRJQUU5cFpLbGJjUzl1OEQycFJWY3VYVlNNMGkveDRzCvHupg/HQxwcJ5eZ+ttw\ndc3Sa4FEFSRPNWvWcmVE83w9YU7dFuIxL0zXsVT/WdhF6Hq0izIXcSt54ROcRoNr\nRsk=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T10:15:45Z",
|
||||
"mac": "ENC[AES256_GCM,data:zqPOW7aOXLnMSvnkYW4MDp+t8+aTjSLse23o3RmTBD+7qGKnV2n+0MENjNPSbRTZgfFP2wz52pRH/kQBiT7TBSaOkgH5L5Cp7wpBfW+Xtk0/zfoHIRQdZE9zjHTj7ueD8+vauMUGldkQtUquHCvOGygpYJugT0PyaE97e8QI+i0=,iv:aAYadr8K3Z0fTeDOqNyx3nZvttrWxpQiyK2p3N85H/U=,tag:zYqAky0ltAHFYdE0nzTBfQ==,type:str]",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
@@ -0,0 +1,18 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:il0+ZwFqyahTA9d7RRB2N7ylGeCFH/FL64rHDk09MUZn79V4I73HYfDrrcSsYQ==,iv:XMbIMsc+YxWuQ5D5jzCpw5F+xazAh0ZTxi1nL2wpCns=,tag:KIMNc9hD4rNKfvR9lTD2EA==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwdi9IZUdacEJtNUJpTXNH\ncEV1ajZreVZ1bkJvbWlvbGYraTJ5cVdsL1dBCk83YnpJTzdIclFyRUpERDJ4WnJN\nR2V3cG9OcDh0MmxnYitSTWlMZml3b1UKLS0tIFBFdzdYZXhPbUR4enY4eFQ2eS9F\nbVArV3BXdUk5dW9BbmQwODIvQllpNGsKT9H861sN8tSYc8OpEbsr1Ru0xmRcjsDV\n5Nq38rIodKPMOTbm/P/luLAhxFjl8BFwm/2wHDnLp2bkBE0WU/K3Lw==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBOTFUTU9O\nV1Rvd0tJenVzeEVjdkh5a1AwTVFBbTM2Qm1qcm5RQzFkVjIyTAozK2VTdlFNU2lZ\ndy94VUF3U0k2MmpITTdkMVhpY0M5ZDBSQXlCamlNVFBvCi0tLSBaY2YvY2xUYWNu\nbFIrUStGQitBR291V1NNYTA5NlJET3U0NUFuaUlFd3JRCtuy9ZUhYoAtoliDPtMu\nu3np9Egh0zoNDkHfRMIwf9Bw+zwhsw124OPUcqckJEZGHSGpwQgU9ftg9M9pCReX\n+2o=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T10:15:45Z",
|
||||
"mac": "ENC[AES256_GCM,data:0OhIPtbbOiWtVUIKkQP6vMoKbCD4aF0weB2ydP1IpPNc9QMW9XpfkMBcrNjrxgaaJYZsIYkY3uBIJIAQ3D0+8hJ4WXHX1G+z0zFzUN67vEeiBiaDl49iXuDCIcuLJDRH1eLndUfdNSKzkAvUewJt8hMqOmvKQIx7iqcP4W9BbvE=,iv:pdHcHE0PB1x6e54xdVh3Wwylw2TqHeJNbm3Y7kwry8A=,tag:KWcbpyrefw/GyDim0IpIrw==,type:str]",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
f3300702451cf9830fb825ee8f55b32ca7e610d4c17cce0ae668e0abf1c246bc
|
||||
@@ -0,0 +1 @@
|
||||
ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIH+YSqh/uMHGCfUT4mZs+8cSeL4IO6sLzMn5ygaiMfj7AAAAINwghtEFis1B8DJgZptcptkbeu7Kb9s6Lwm/8xyogG9fAAAAAAAAAAAAAAACAAAAA25zMQAAABwAAAAYbnMxLmNueC1uZXR3b3JrLmludGVybmFsAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgm6FsBpLHl+5qpNhlbTNqNVj0c4fFN1+gN8KGp2BvcaEAAABTAAAAC3NzaC1lZDI1NTE5AAAAQMEFPDPt2JRC88fJzMRb7CpVT9cEOFA4lr9P+673gKRwpIC+0w/YjUcxSCXVYxjF77uuB9+53RJ/ldaw6H0kUAo= /tmp/vars-vc1rij2g/in/openssh/ssh.id_ed25519.pub
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/machines/ns1
|
||||
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:tkn0HX0eo31zj58OWPGmqjj/J3hb26mbn1iDKbE/C1BTWdYn8nVYvEkmDgfU/jbQxmClBmrlxDncJcQNP/49hA8mZmYOdNqZ9w==,iv:TZrI3ZE/qvKXEp0YXdoiHq/H0+XkRd3VkE2DwOjls30=,tag:SXwe7z2hsapppWAO4o25Vw==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaUWVxSTcrbDFFaGxGdXQ4\nNnhvcHZqTUxVS2cxWjF6V0R2dzYwNGViK0ZRCi9mNlIrZkFBUkk1WFVBVXBpN2tp\nM0RtT3RCOE0rbFdoWHlQL2FJd1B4eU0KLS0tIEJpeVQrSlZJaGR3cUxBY0tHbXE4\nYWFSVnlHZnBibjRNTVhJd2gvQW15ZlEK2pNSIu91BXgYSYkla5rPy/DInZ/St/zX\niovlqzPsMRRPVLhyeQTcWBd3GNfW3TK2wbSXV6+D4EJ+g9M7Xp4h0w==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1fanu282vm7njjweqhrpcfcwpttuhce8js4tsyfry98l0neaqpewqs5s7nt"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBINlVWK0lUTTVMTU9yTW5a\ndEJhSWVUTkxmUEhJSlAxWlMyWWJyZVRhakZRCmhWQ0dXbll5SGlBSFNzb3Q0bGdp\nREtGSFdyUnlOaCs4VmVqdUpZRWlPWVUKLS0tIGh4cWNnNldUR3BYQTVKdlBjR3Iy\nc1c3TUhSVlU0WDV4RU9FTFk4dXcrajAKgoI0vvySxukoht/nY7OzfDlcUyESsXtC\nMdWeUnyZ0ABZtj2kyasVDnYK2cYj2IWN5Kk1eoN9oBdRdyeGv0AvhA==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBM3JvNkVx\nRTFPekp0V3RyYlpVZzNJNnFuU21zT2E4QjRiWFN0bC9XUlNBZgpLd01SM1dwYnA1\nWm9FTnV5YmZvWVh0RmozYjUwejZUNTdRTTVZNHU2Nm40Ci0tLSBsc3JBdU1aS1hz\naHVWcGRRU1JhUFJZWG9WVlkzdHR0R2ZoR1FJYXVqQmhjCkXzvRnr6WpBNjlXFdSu\nptMJ77TTE6PC6OCZC27ISNNVx1sThSDQZ7RBIazlgfhCqnOai7B60qeajF4wmKCp\nowQ=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T10:15:46Z",
|
||||
"mac": "ENC[AES256_GCM,data:YAb8vcy1qUAk8LsMuo/4p9HFJjMp3WOlijYkMtkJ9cLROg646sjOf+IXLI6AJ4e1W+l27L/lmwPDYUdN00qUnBKwM79J9te2SGZBBp83QPQvahQ17hXoDOR9Pk36IWV4mBTNJS6lTCc2wlKqgSBf0Y2G8S3NjlNbeUgX/KEr85c=,iv:iRDQ8B+F9MSlVFzJ2nG7iJvcHdqM2fT7anYBjtYfqgw=,tag:zXzzQ9gkL8jzvafGr0mNlg==,type:str]",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
@@ -0,0 +1,18 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:4YDwCwqhM7nG0el807GH2bk95U878VvQ4gs4IFCxoxT0EHrkI/4JSEt2iQqSNV564A==,iv:PuyK1EuhZFLar8vepxGpAc1lMfVHPfcwBvImS852mUo=,tag:yUg04TKfG+lsN39l1JXnUQ==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOeVBUVlZ0RGt3Y2gwOGM5\nQjNiYURHcm5nSzhQOE1ZYXBsTHN2c2NoZXdvCkV6OGwrdnJPc1YwNVlMZUZlVHFL\ndVI0REZad0xhcGFuWWdWYkNjclFIbDAKLS0tIDd0SWdUS21OaFI2MFNpT2pOeUZK\nZm1OOXFkc1Z1ckc3VFJ4R3lWbXY2UG8KiFsMOwdkDDB/p0JQCPxdICLG8UqEvmlG\nMZuCNLjeHeQyEaKXSzIlpqIx+g4eUUu1d7j6Le0HsV6hn2vFxqLV0A==\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1hlzrpqqgndcthq5m5yj9egfgyet2fzrxwa6ynjzwx2r22uy6m3hqr3rd06"
|
||||
},
|
||||
{
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHFWcTVydyBBakc4VkdB\nSFN2MjVVMDVqdTJDRE0rMzVmM0dmTmIvb25NSDRRSm9mSndLegpKdnVVRGY5cXN6\nY2Y2ZmZ6ejV4aXNpa2Z6UDN1OXE1cWN2TGZJdnRaNkE4Ci0tLSBrNGRZQi9HMGpJ\nayszSndDcUUyNVg1SHIzMFJhemtoWExyN21MbDhjc3BvCv/40YXclyLfnhtKjRoE\nIfmWpAklC+GcWpYkw2otWUwyiBMSNtQ7wvbYb1uAS2NOeEJx96zo3OwCWu3aAg6E\njzU=\n-----END AGE ENCRYPTED FILE-----\n",
|
||||
"recipient": "age1yubikey1qd859y9ehz2ya8j2cftwrtmdeqhuk7r7yc52zp64wpff6068gwrac3q6nsa"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2026-07-28T10:15:46Z",
|
||||
"mac": "ENC[AES256_GCM,data:Aqcw1ldHyBNdbvu+jGUPecQmCiwqrWVhkcxaUfR91A+tfeMlEwHLvocUQcyYinHbTVXhMrq6RTkLMc6tNXOBc0i0dC6lG0blzCQsRLKkz+s8VGAJUyH60aCxiSXr5Bgn+BNyDUju1TSoRkGpdRNDK0m9yaX41hoZXIyhN5R4r3o=,iv:lEJFVOTXC2T3OEOc1DLSdKZI8cKKW5fU0Gzp17qhU+4=,tag:l9VYXvbGdyrM5WCjqksPaw==,type:str]",
|
||||
"version": "3.13.1"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/users/berwn
|
||||
@@ -0,0 +1 @@
|
||||
4cea323a401ff86c4236f3c4b20d955f6c59bad7a8e5b3410ee1cbc4a766c4f9
|
||||
@@ -0,0 +1 @@
|
||||
ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIDcci59z4DhFZKBubFATQZZlOyfEdrwgw+nxQv03RT13AAAAIHeIhw1Vg/FieTZKXFZthG+iVjUcXfhjfy1EQRe3oqXvAAAAAAAAAAAAAAACAAAAA25zMgAAABwAAAAYbnMyLmNueC1uZXR3b3JrLmludGVybmFsAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgm6FsBpLHl+5qpNhlbTNqNVj0c4fFN1+gN8KGp2BvcaEAAABTAAAAC3NzaC1lZDI1NTE5AAAAQAJCqxKFBEqQsnoWyl/yKVoTIV2l6AjqPNUTRf7p0UUjXYGnvTzDoAouxjPshKRgaRnboA4rcT2gX8LH82kVVQM= /tmp/vars-cbof9yme/in/openssh/ssh.id_ed25519.pub
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/groups/admins
|
||||
@@ -0,0 +1 @@
|
||||
../../../../../../sops/machines/ns2
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user