vpn: Add config

.sops.yaml

@@ -5,3 +5,7 @@ creation_rules:
     key_groups:
       - age:
           - *primary
+  - path_regex: nixos/hosts/(Rias|Senko|Eclipse)/secrets/.+$
+    key_groups:
+      - age:
+          - *primary

flake.nix

@@ -33,6 +33,7 @@
         };
         modules = [
           ./nixos/hosts/Rias/configuration.nix
+          inputs.sops-nix.nixosModules.sops
         ];
       };
 
@@ -46,6 +47,7 @@
         };
         modules = [
           ./nixos/hosts/Senko/configuration.nix
+          inputs.sops-nix.nixosModules.sops
         ];
       };
 
@@ -59,6 +61,7 @@
         };
         modules = [
           ./nixos/hosts/Eclipse/configuration.nix
+          inputs.sops-nix.nixosModules.sops
         ];
       };
     };

nixos/hosts/Eclipse/configuration.nix

@@ -1,6 +1,7 @@
 { config, pkgs, ...}: {
   imports = [
     ./hardware-configuration.nix
+    ./secrets/secrets.nix
     ../../packages.nix
     ../../modules/bundle.nix
     ../../modules/gamemode.nix

nixos/hosts/Eclipse/secrets/secrets.nix

@@ -0,0 +1,9 @@
+{
+  sops = {
+    age.keyFile = "/root/age.key";
+    secrets.vpn_bolt = {
+      format = "binary";
+      sopsFile = ./vpn_bolt.db;
+    };
+  };
+}

nixos/hosts/Eclipse/secrets/vpn_bolt.db

@@ -0,0 +1,20 @@
+{
+	"data": "ENC[AES256_GCM,data:ydsCEGsByCiHMkZa8SWg4ne07sK3n2qsvSSAWffxX0QlmZrEyRAQcz/QlHHepKSIVkNRQbGM44v63Qh9UDsbe0UajA9jMV65CqTJ/19+p1xJI0m45/CXJB6BQVc7FUTX1aGuvPi5M84gwebf+Oy+3BoiKHWdFFJ02Yy1/+zQfFr1XB+z4Ca6jcNf2uJtKeP0eMM5Pq7VJdwb3nxBLcjKygifDJ2FXT+W67Gevu33dKhlbUWAPSpLswnvdpYLCeXge5bhdEIMnP1NoAJa5N5Gp8iK9iZM7UjVqgzDTb8b+iH8oCsUjfn7JyKMCnnq9c5YfV0FMS6HmssYbMPcV9zJYETWiG+v+Jy7hPvQTtmV2mft19V6p7PbJ/lImcYscF2gmKPWCZPmByS0qPmZH/43dyePC7GHCYQji0PTzlD+Vv8dTRNR8sD9iW56QX2zUgTb+fhXFj8BY5PXRS4NbcoePMswi2hyLwMDjo2oDO4d+wDZm17MRYTDiokZV/suT+t5Lt8+QdNYbex/J++WmcBRme3YRKLGL1Fb7hEKfyhnT35y7PnbxDKPBXyJTlPyuPBoZDLfNFP8lZzYIoDlPLqy9Wc6kZu35gukmXjacNP6eM5OxcYeg5wdM89OH2X0fkQOHE8nYGNok45jwsDksJEFqiNAo+YesxEkeUWwhs4dWE0FnoPcAvcpoNKC2U3cJiVwcC62gKAJDzoY2TZTVA19KQLpKKAojQM2fkBegMEmNRWYxTQG3JaqdbUYBf1DBjRj9afRrgZaaAb6yjypOgZ0ffju8Bwg8DhDjvEGVj4l/d3K6zt8yPA5B0qLg8qqJALZ+jzPyAWTp6yZ+bRF3hnrd/lFnvXScCd3bFfOSjsafRLj82srx9jnqPyUf8QRGqG2va6+crYUAmaHA6cowIWcQ5/JfdSXfEkdqXVIo/w6mPYNIZJKMqva3cN1zQFTCRQ/MJFzp4QIkp1/9wmfMKJ7WPFODY425IKGCBM0XZ2NkiupK1hG7FS+TJhdYkX6DGetc+Mg3UG7Kj4ogfhyZMU/Zlm2lqUKUVkrmh6WeKDC9hMmMDvwjG20efa2/qyB2n3RJKVmGFpcPj8AQwXuOqYbnT9gbFyJGIYeZC5AO4f2RMHMcpQmxLxOOmFcN9OaWIHYazDc0Hn0tdXFkofnMxLiu2+OGLsGup3AKIMA939mZD2Va9qadzb+P2eVwOZWSFuLV+6uyVVikUPDVO51DTDSJRhH5ANKJGXUmIYLYXvPL2ffNbn61zlxbZH99tyGHriemLF7wJ4dy6Dbxode+ut6z3mBkn2jn6ALHJWFrxK6O+lA+/oh+gT0zysQLHZp8Skm9JeEON3yXahVCKyxzv0jBJEx9jHR2S8N4zUfWKNjcuIQCSMnZVzu3ilYrBW7s7CG7d/7tOIBBVztG50qaJ5d9Y7td1IcO5hDy0t0v2N0oYcNxs+IH82mAdhzvnjc8sO7vd0CYDya6m7KjpvKDh5Dpcu7gxg0G4WkNDnKZm7D84NcWP7Xd61CrXyzfCwAp4J8ja642j5ugXcdJbiTo+MDA9Sazg/S9Q4f6zOCHJBfU4NqMeO7cokLthaPPGzfc60CQBYTrMkmDZLgJd1UG07mwjDHWCOQYlAa0tf9sR4qfJ3loeY23tBGk9rgtv8a91XBUU6VO86V/43bMIfMDHgmP6nLTEo5bIyk+VRqLPwV6QyLJGfb1N6LTLUaQxVJNIjs7gGtNtiBpAVgGWKqdqgoM23eDwsNcyLw3wDZYuAI3SXNnak7VZBt8tXR2caE66t5YvlAK7/USU1tLpxB51XWiI9jkYDWt+uMbJtCi8XchqcNoWnnvuA2/YAdrTfswncThpNlxbMwNG7USKrQ2pi1ku0cclBDUcC0+XnsB6Ue1XO4X8zViwE2wD5RTHAv3s5fzS2RwbKWzkuCzYSIwBDT1vIqo/wfK9s0Hz0HBi1otF9M6vzOND8Od7imRfCH4ABr2UL7hqGm9po7j0xg5/xcT+1IWcy3dG0c3JJqwnryqpLi0A1fwVOZ60NplHkqX/iZcU+am/1pww1oWZbLRj4Jy3GaOSoqNmKtxBKIqgFq7E6T6UVn4Arm+kqasIcoCMpsLUJMQn6F2ZXub2zbz8D5/z0RsCP5keChqR3Z+/t3CzglC5CjU/a9sHozr5EL2sQJnqw+G3a6592P0WkekrZj5tIozwo8WFb6fSaoy6fNdBw4smJ0eSfdsySLXDZooq9NH+JNu0UPdHNU6bVmGkQBn41csNwtZ7WC7aLuKgXy3ll8HReavcbNjkRq/HVsydiQsiSHvdjKssAUJvI02hYJxRKA/O2zkR+j2aHnJUQZmfPmAiK+vWzanvRQqHHIvUZa/7NJI8VgfIUhxMPbKjx9ru+LvOwwKyHxC+86U179inSCtMiNKUsjW7UUkc1V+CsL61/aoYxS6MJAaJJ4tCsGTt+lJxVJpRCiu3+NN8EdnRkCBl7twUsN7/WRa25BFQLI9PSugtgN543HWKPF+JTZJ/o8RhqcGYOsdAlouFQ3uhiPV07wGRGXSQk4+Qm8FiKeirgwHi8LAhGTgqhPk2tQ78rKpEITIAGdDyD5Cdq1l2uNWM6mw76AV0SBXIkw9MsfCBOTSyEKnQ32qLP5M0blCdZ2q3WSnM27Nf1z1ZnD4rK5K6iiWztYSjn9BhyqLmptzxhny3TUMeI3bWzzEUj2lpV2KPXUAYjvLibWCqFWYMkNUzyEbEIq2sPyCBzDag1krh9vOb92OKYpEPvALIRZ+75ueE+BP1RdvlDbzq/vd6rA0kOnqrOXWvXDsiJv56zClb6WZ1XfH3ks/Y+6tdWwdtV5YixJeRT3E9/kyE0TgRQBYBhpkGjA1+e/B/InqS+j0Rhghjfm8KyAnr6t6Uz2qIMxp8zrUV2lk8uU44XuFpQAOaai0FKgJ2VhMLW6nV+D33gFNwgoYyw2gUl/1IGxwCPxIUH1QBHcxBgxqB+kf015yhsLgRhkVpCst3gJLHxzvZRlKaKFzCm+l2ZRzYaHBiW0Jk7UVZwUyXCAvJZNtkzgaSw3WwzSnOF2Vys77ia13BFhNzLuT5CNwb++LnEMAmfgAzvVk4GQILfd6VYKI1Q220NJW42jyl0l/yIQXG9qlFPL+1VVEHz4PNK5K7aHoGDOBcmN5t47ykaDYNCPXI9hZZnvzYy6NexVcq5TVJbSt4XecsRQFrrtqpuB61VjQJtsXAJfuXjjG5SFyWX/m2S2pUGK3nf6Jh6DBQrzhcjPpGYi+hwNBALymVikyT8BoGkkqKMJbUAz3cOfQDxFUnZi9Yjamaf+6l23ojobaWAXb8eqIgIlg3QIII5YzjvnQoBYhtMsE9TASI/4NInOM8frr0CoD/JQoY3HUbvPh7Krl2to4NMj7njstqMN1kOQUkPF8kR7DFH5W1NLwWSKVuvBifd9yBBknSKUI4NDCWN8g9DaVhPecDUSlayEF7P21S7QT1KkCICNKsd3ILhFW9A5Nv8Uj6yE5K22RsLmZs0X7WXkmiBQjyWn6nSvMJ1DT7GStQPHiJ6mSNV6NseyYFkPVGcZBqp0lcjvWtQ9Q8tR7zUonj8g+88GWUvQN4+qk7GolkVM70AKIH2dO9BwLYSgxzqcGgTTYvRvUdJgNGUWIwrE5dHkHp15WnEAmjhA+dJFAEheMFJ7Pz7eIRxgzSGE35n6mID1r6OHLg0AVepQpVzaDf+Ma1j5RGb+zvSFD8P7cpwlvoqOtzsSwCfxZN1iI8kQ74zyUKg0GdciCJuHdHXf+YtgbkZKu47LkFGIqddDpa4twPGyihm9XFWQHUnuBxXASwsEZaXBYPB2hG+qQ0216wV5lsVJLjTe78YQR2TrPXNXe3qMOMA5zUK76BHS+i/80FwG5bWA6Y1AOIobxX0dDPweKlMH6WQI4Ks3jasEzsnLMkqTHiWo82EREIQokSwrEo0JtuCTHCtVS4tPTIrDIMaPaPIWJVmFPZRUSFmdorbvSnWE8I9oHhYJHLmTs+vOgbShDHd6Ysfkb3H+SBcv9GsUM+sHbMlorviCjkIWXp5oxUQdwFD6O84rpL/It5K2dAyqH1nyip9R43WziOCjPREbS77zHEuBpLVo7Rrh/H6LcAFyVD7DgxV9mtTl9lPwDw3KYdB+MKsymHZYCWakud6job9ES+R1/Qs/W7rIBMMgPh2FtOX76I8/yL3AeKVvnBmUuSW2CoMrSCf/WXhhwbyUToyXf7uoKlnNLy0NB4M4FTCoAY50jy8yVZu3n40KCO1089oSNrvxE7IrwnaEuAQ3PuBSaX2wwiyfmq1pos3yXz0WLahWfYe/Is7yfP9DsWB+cWBbLoPypB6X+taOPjC5MMtwWUSYQr6nCz+f3fEv+Y8tWxkPSs/sKsX/8IuwmNnUtu6OnA8AFhvPsjz4NY3dn5gEFrYpZgZtOkjTBB9/ARE0PUfy1xDI5Zbc8HfTgJyDONlyePsY41SXoqEs0USbrbLlq2tLAV6carriyKN36T3T0Er7aaYA6DVHPb9xEtOe83oVQzxRj8QMVifbuKjJ28myWS6RENsBBipJPaBaOP2AQ+nSu3IQhwNbPKtiMzUPUfypMjfisqKD6Sx7yhZbK0ffWmfIW5vTHDKuLy1SenE2yNQDJd/5JkWFGBonXitjRCbuJKhtwvCd6MJjwaM0oliDyiOVPPqGcUQ4hV88S037ZpuZmILnaJif0X/eh0uElnSDt56TaVr4TYbh/O6ejuTFkmv6R/hWHmt7JsmrIfBJ8mbDFbxaLiw1qx+OOJcuezqSLxnVmA/0EK6k6vggnyNvp+B047VLBiOybKXqnlgIa9d9OJGD7mVP0CdwoOMuWmKOKSXlVnzbSxUkypnDxHc2gXq7zYLqVLbHY3Sv7MiSYYU9M7wCow92UGKtN1DJ4TD/S7G9+JEs0Dx2WWLiSsBWxXjAMl0gxlzVKn+zELWZqNjiw4BLBLine truncated
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1j3uuyax673fvl5x4dveupq3dylngnrq0e5uy7fmclsexkfd25vysk646wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJTGRuVlFhTm1aSWplc0hl\ndCtrZ0I3TzA2Nk52SWRqalJheHNSbVZjYURZClVBbkdPVHRLbVhsVHAwb2U1NkF2\nT2dsSEp3WnFVNU51bXpyaU4zY1pYOUkKLS0tIFg0WlNCRzBoQ1JQanRSbUhoc29u\nWmtRTldiRlh6TXByZEwrVkNqeW9LSVkK+42St/pflwAwiq9VUXg3YvdhNShVJGK7\nOdvi0T3+jWViesMxDtJxlgiv7Dgc5yQ6s9yXtXYn7LdEDluWiaP/PA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-11-08T14:33:09Z",
+		"mac": "ENC[AES256_GCM,data:jFaL+b8kJtA3GbAiS5PdTQ4L6BoKEQlUKFAmT5mBW4aNpBZJr91OFhfWnkhW0CirkW+VZJvj76hq79IrVBhYvH1EL/HYBxx9YrxzF0Xl95j1zwCFwGunx8EzVkDlFrDq6Sr6ygR2rgBh/gHuDlhmmtpyyDp2FffLYV9+BeTmDZY=,iv:OuFnskVt08vLZ+MC4ees8n91ry9WDqvifdL8Z+WAn2A=,tag:KUyv5b21t1B3S0hCngAOpw==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.1"
+	}
+}

nixos/hosts/Rias/configuration.nix

@@ -1,6 +1,7 @@
-{ config, pkgs, ...}: {
+{ config, pkgs, inputs, ...}: {
   imports = [
     ./hardware-configuration.nix
+    ./secrets/secrets.nix
     ../../packages.nix
     ../../modules/bundle.nix
     ../../modules/adb.nix

nixos/hosts/Rias/secrets/secrets.nix

@@ -0,0 +1,9 @@
+{
+  sops = {
+    age.keyFile = "/root/age.key";
+    secrets.vpn_bolt = {
+      format = "binary";
+      sopsFile = ./vpn_bolt.db;
+    };
+  };
+}

nixos/hosts/Rias/secrets/vpn_bolt.db

@@ -0,0 +1,20 @@
+{
+	"data": "ENC[AES256_GCM,data:/afGpZqBDP1RLD9M0NmsKxSzytOkNVFajeHPEftuknIsbvBVbOwLj6GxeCiLl5ipd1CBePHxgOOkToBnGENiGsb2679FZvhaxDXsjV5xglfXx7hpErDlX2xYzB2k9/ZYY35EohTaVz6FdrHm6utRjN0/ihUq57gMjnlytXzsEs3b3uLXrNDMNYgPSmVITu2e/jWAuWKaJsWmKPjK1mD1y4s3/NLf55KDZUDbpEWHHzP0UU2+ud/H3KgYjnlVc3hA5X3sWGKpgaZgodc4Rou4Ksb4Lgg2TM73AeMYk15n+S2uU3iC8G18lh+OqxCCh+KnL/z/IBf1j9LTsEThhd4x98yfjE9YR8S5qcPucxGcurXBm1CwuKeSsHFtgGUUshGdBcNutBJO80VSkiHOJ3PwuVzTCNC1n5c0N4Y3fVXlEPnRJajAp41sXGEQh/1eTZ/o5sXuecsS7d3bBAG5KJyp0UCxsiCCb1qHnVWKnvUbRS7Yohq+3yi1oOdjUu4HFzcFcnajgOsnCRmhFw71aVuTP9a5ufsIhwvHe8/8wC1SoFODePfkC7jADtmQ0cu+jR5DE0dAx55/DrnfYbSVBxr0LClzdhaB6U2nVFmYQsXGc38tPlyBTDiV2scAamDtcc9LOf9BndEPBdAAEVABduKpTes/C9wUcTYgU+75/sw9RlqIMtJw1diQOUNc1Oo7xxfgIIND+tfGNt/BSRHdY/0S3J203VP2QrdPukAQHLG5ZNRV62wcXK3i30mUZHxp/zRy8VSYsE3Dnbnom3m6JhF2tmUZaJYRQv52wSytrYOIVuwj+eIqgGdLqSVCQIfoU1hDdNCF04esDzjaJBcoqhcglrb8eCkDVBe0sLbTe5IQoAa7g/O3HSyvpfbgEBW08B/MxmU1O1VfGvIcGnJPdpMCq/SiiVgh6nsYMphCFJLK713KChgF36Gj1GjQEVcRwvUhuYY8TFzmghYrqH6lQoSk4fL/umUHAIq0H7d859cP/qcrH4L35EW5QN+F8iByzXtH4BjFy0F/U86baqH3S3UqVTaAwJFIu6KgXSdTlhpTYJOj4eNiC0zbDQdUi2YG6TUvk5YdFb4TDo6Bz/SsQDIbgaR48PMP0Wi9Zd0wH6zZh+ka1w0K5SHVjb45Sv6t6pI1QUFM1ChRnPCJ7yZ1gpC3HYa+Puk15SWl77ak8kVZDwYmVNp5IKq80pgL9g4Y2EU/lbvw3TQsvQFB8s02A6k2aYoUPQpA4zoz9D6dYVLSKSOQKWeU+3EynAEC/0O5k3FAHQY9WkuNgim2QG3uD+YY6KoKHkrJCy/9qC5NK5gluYKooX7qTcHcRRFV0aOn0lCECWhNceh+fZTe1OofP8Yp3BZ9VYU/8It4R358B0baABpEM7Z4KTPvKahn5DqqiwM027URxpjOBVSjbPJ1KSKTLBHLb6JYZXQkm4z5dorsO/qX44yYa8vRbsP7fJm+zi2hjNE60nM/HXeNgXxz/Ut5pc8QNC2JlTMBjr4qUdfMS1a9Sg8J/+n63FliohPvt6zKYsDhvirhgtoS04x/NJQq7AvR2ejxfh5VfppT3IMatGLfF0DlhH/1qwTaHTuyB8wKixcmyaOdI1+KyYNSsWSPeIgBQx5mRKdioI/5AMPKp8YGQl2x16+q9FcFWmAKdOeCZzki8bf39lTFfgW09gP029vAkit3yjLU1S3K1PyTyQ9pA9b7fKq97ThwabFMadgdpi+/8jGDe9VWbMeH7J34MXbYW/dfMgZ1t4uEB08b0HLK/gGA+4DZzDRcUwAmLWPObt3YFwnVTNm/sgZL79bUG0dlNFbShDcMuG0ANc9aw7k1rx35UhAe0S2/12ik3djenlnmUicB7EwlmmgqcIOS0Vfy88/JEVJNFbqhOSQuIxWuHnTgaPEP+Lx6AOMz6ttYxFzFWM2Ute2S9CKAfyK8FbaOW1XiVn1323iJhVdQBPDxyLdDHJKEnQHofHSTNxDbKoeCDWBqIW1S/TK5iMSn59/A7zEWHZoo5uOhH9ei1TL+3zeG0zgU6okXSuA+2Bw58qqcRbXkD+DNxzFQe6sY4Ha1ksqJ/8HuDI6D/20V1hY4a2NpU6AYRe09b5QjpTLSzU3YESysi/R/YLE65hu3xBTeDjbrcTDXiQ938fJLRoyMQep1KI2kCrjoJCHG/dTJ7FGzAwZpQesRP2dnoWJMA62MDWBRRU2HkkPZfsmeKkQyWodJbOGTon0TioZ2DHOFALkfwSTwR+qoVr74uJP8OgyA12MH/OBtQInm77sXRyniCUCuMXMD19dk2p9pX2fkxxDNLe59cSS3qTCzuqPcMnXG+C8q9URTcDToRUSXEOkFKvnrS5NkrAqKcLbLF5cpqVHiGPI+ipmaxPLdsF0VCFlIbQCUr1WpzfdASnoE/vYqR0Qf59g9tw7uYEDbRGTbf6DCCSmGfbZ8tpbI/eTTJsLb4r6qrY8mAk8YjAFy2IRBaUeMRwxnbTiB1CiXAczudeC7hc5JfFK7ip4b63fjSW4MAuA6Gzuz05TSnb29YZosYhmAXwbXlauggl14zY8M/ekRV/zQKyzpEMPJcWPw+y3sko/il89js2MQDem/yGJKqcGrJgbibWfUkE2d6jRUVqEcLbeKqhvAygldIEs9DffJEUhZFLS68VAHr+y/vM3/MaGFlURVjS7q8f9VvbkbU5v+NJFQBkNToH1eWiTKpU+/5Db2t6rHHhhznwNMd9n+aJcNgylPGlnOFRkFqOQWyRzTm2EWJG+xV9wde1CUg30n+O+X+rRwodIv6kW2JunXJV6WO65+Y7ouJWZ+nv+CH9cbRJLA4aMiOflFlXd2PkR9PqGwdMgZRFNKsUR8sAMv53/hs6pzVtVeUtk3ds5vmn1s1R01G+8Dfe0IiTa9J6/62Aa7yxqXA6U6dXRPuGH3mezeKJUULcDL7kUR+uTmnn7SPrJJRQ29VnqpOgDDmrnflBeEFxEroVML/3L1ANdp2XarRjOijLq6oJv+tHybW1Qjuvc3TtngyNWnt4vfHAwNYsyAidZsTgd3xYhvt2e1HFqBE26u8Jwn7zxEQGZDSK6yBAivwafrMbJNA+7J/o5CUSkdLDsnpEd3kSccUdOlxmkY6q5wdSq/2KkaVCVaIMy/X9s8aHelr35BkD7aq4zWN/L4By+ZB5wzLlGNMrPjneNHtCVpcP4ObEv711gGnnKzkyijDtZD/YnxLtADh8aBcI0C9cQkvGc0SQV7Adb8H8bGVUkD25N4DZWWPLKDs2D+AcYpOJVZZCcBfDtR1R8tPG+EpQc0odu6Qn7yZhY9BGDXdq2NbKlAqrtzxugOoGEIDENx26iCeqjIVW2T+tRVUoNp0djeeW4/JsSTPQNbpCwqYh0C2H3i1jbCbWvRZaIzV6j+7jATMBMykJCFczeWmJU/nPKSjj7yJNy54Gn1HUcI5MTZ4MFSpezcPXe3GrAuvIVliBoVToWvN1JDgPwdWMFqqBK/MydVW3jFP2tzumH2VauLcrd5zmL6us409tL6ZVwEzTrCRvngwMpEejFkoZhhYFGxAsch+++crNOPh6fX2c3ZkAyZ3W4pUH2/hAkJzxJmKZnTzHmyGtKenqtloCWiAPI8JU7HS8DZ6ZoxkaMFn1EJYac0/4V0pe1yGD9kwzOstuhbSD9M5mrAVVh3hWOM7knI6rtzGVi0U+aLdO9RUP4mDNzPnNvXueOl6jh07GD6dqeK5IE9LCS0wOwU8BjiQaK0qJHsjnHfTebZYTvcyV1Mg53sv8FkFSn0273gswLCza40JqNDO/DU5TNaRcCovFTxy3RAX99TQ3N4VceHbyme20iQ/qZ4Zfg6OBW7CK8zfTuIIR8+B7uvJVUf7x3ZQWJHIDduxk0J0iHZPnsbEdBIWI2K3RAPWzcbSUB32OcZ5lpsNXAg8kBovJhsR6EPwX9KfLrEFfNzuUWswW6fOM3j6yTkPdit20X/2oL7IBtNeaQa90+DkLuC1od8WOlij/AQe16o5XXTslQxyjWKjQwG2k5kt7QyhlQDG1arQbLKPSKkLtajuOjDG4fNmOQJO7a13mz07EuTTjUjmtbYNXcolrHk96eW2u87MSIadlk3l2ncjFfhCIoGLKczK2U1X8uWtWDiYtZX8xxGmAzr7fI9NnvoHKYTUqEfRoj4yIzxQ1QzV8saUsn+yG33rKZHPabemryV/XCGXybwXdLYafDI3goiZXCYlaZCAC2iZzofukvZ53NIQ/WANZ4lomvPS6/KeMQ4BL+R7HQej9XwMc0jKTmcgtCh0CdrtHTqxyM86X+LUX4g5K88QY+t56BVHr3v04u9ZTYpNMKFKQpZdguEoCIiT4y04uLTfhsxyTrOmLeC6w7eCNc8pwnUxP4ciTYEgYUCJ/mc22tBeYLPnE2nL9PT236ovR08y0p3GQFj1b89m0p6Zzk2+coqCslkT1Dlwc1rSnFWar1IfoM35TD0lNbJScBHeTYuri6ep1RQy61w7isC2mnA7sF9E92cSs/J8Bj8uK0Qcbf+AZWw9T2Olds5+ONcZ9dESLkwrp/AFbLkm9il9JN0N+hApl9ib5zp3cdI3ulHEibDMTqOT6qgNUG4aciJPKAgA1auGmm1ruq+N9eFuBzx5/PUqbinhHVm0eiLZmHi2CBh9fgXlWR7J5rHhgp5Y9mJF+ZhDZF+4hQY5LTn9YYYwws8AKa8DGL4d3ianoNtxchWlTNIdAGnQRJpmqsVkOxx7Nac8J2xQX/Iow+l7OPmPuhBjIYf0jhOAmBTL+2BdfXBwgYVLQoH5J33B/1UarwrL9xbitljP/IryegO64lqs6L967P8z0iE4xS2bBjsCQRWgDhYGTcUTyy/r/TPJRa7SXA9ECullTYv/ZHYQTUD9nF/ddVKcGPtSV1jvsQ+s89z4S1qAbF9cPfZiIumHt3k3o+RrH03QUTS5FkPHkT9ShbOZFi1ng29SsAjbEhu5Line truncated
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1j3uuyax673fvl5x4dveupq3dylngnrq0e5uy7fmclsexkfd25vysk646wk",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VWF3NUxHUFo0K1Nvak9I\nMkE0SUg1Mjl4eTM2VG9WRjFadDRJRTVoSGhFCmNIaVlweG9GK0VxaXhtODNVTW5z\nWDdSYjZBdi9qSi9ZTkdUcTAvYUl4NkEKLS0tIHlZcWl6dmdtbnZmMjNadnI3TVYy\nbFRDNm9XRlFZdDNPdGVxNmtYUm5YMEEKlTJZsxFyVI9Chq2URLsaJWtY6zyLAwzu\nLEoXYtMrViJdAyq/hU1tHYGtPNNo3TG7Xle9m/VO+7Ll+rcGwOEpbw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-11-07T19:55:09Z",
+		"mac": "ENC[AES256_GCM,data:DBcAJyRBB+jaNTMC+QMNex7CmYJ8H766I507MK6vdowhbJ5B/4LhIb20tCMT7+yKQsI3RCWz6wHiKSflPZTgHia3YEJseb84/2JtwrpG0xDcUU4/fbBORDdP+au99G4EBXtKS0pREAZX2bw2LFPdmSO83UZhVpc/CW3Asm+Gkv4=,iv:AHQWsuWQ8F29abqxCBejZVY9FW8bt/S4xXsnScqo8Oo=,tag:JhTbphtHuOlJtn1CPGCvjg==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.1"
+	}
+}

nixos/hosts/Senko/configuration.nix

@@ -1,6 +1,7 @@
 { config, pkgs, ...}: {
   imports = [
     ./hardware-configuration.nix
+    ./secrets/secrets.nix
     ../../packages.nix
     ../../modules/bundle.nix
     ../../modules/adb.nix

nixos/hosts/Senko/secrets

@@ -0,0 +1 @@
+../Rias/secrets

nixos/modules/bundle.nix

@@ -12,6 +12,5 @@
     ./vpn.nix
     ./printing.nix
     ./shutdown-on-lan.nix
-    ./zapret/zapret.nix
   ];
 }

nixos/modules/vpn.nix

@@ -1,4 +1,4 @@
-{pkgs, ...}: {
+{pkgs, config, ...}: {
   systemd.services.v2raya = {
     enable = true;
     description = "v2rayA gui client";
@@ -7,7 +7,22 @@
       Restart = "always";
       ExecStart = "${pkgs.v2raya}/bin/v2rayA";
     };
-    path = with pkgs; [ iptables bash ];
+    path = with pkgs; [ iptables bash iproute2 ];
     wantedBy = [ "multi-user.target" ];
+    environment = {
+      V2RAYA_LOG_FILE = "/var/log/v2raya/v2raya.log";
+      V2RAY_LOCATION_ASSET = "/etc/v2raya";
+      XRAY_LOCATION_ASSET = "/etc/v2raya";
+    };
+  };
+
+  environment.etc = {
+    "v2raya/ru_geoip.dat".source = pkgs.fetchurl {
+      name = "geoip.dat";
+      url = "https://github.com/runetfreedom/russia-blocked-geoip/releases/download/202411071531/geoip.dat";
+      hash = "sha256-BBQUTzUIWpSjFxv3R6hGfoE+WTeNcVpc7Ge3eOCKxuY=";
+    };
+
+    "v2raya/bolt.db".source = config.sops.secrets.vpn_bolt.path;
   };
 }

nixos/modules/zapret/zapret.nix

@@ -1,48 +0,0 @@
-{ pkgs, ... }: {
-  disabledModules = [ "services/networking/zapret.nix" ]; # необходимо если версия nixpkgs новее 5a5c04d
-
-  imports = [ ./zapret_service.nix ];
-
-  services.zapret = {
-    enable = true;
-    mode = "nfqws";
-
-    settings = ''
-SET_MAXELEM=522288
-IPSET_OPT="hashsize 262144 maxelem $SET_MAXELEM"
-
-IP2NET_OPT4="--prefix-length=22-30 --v4-threshold=3/4"
-IP2NET_OPT6="--prefix-length=56-64 --v6-threshold=5"
-AUTOHOSTLIST_RETRANS_THRESHOLD=3
-AUTOHOSTLIST_FAIL_THRESHOLD=3
-AUTOHOSTLIST_FAIL_TIME=60
-AUTOHOSTLIST_DEBUGLOG=0
-
-MDIG_THREADS=30
-
-GZIP_LISTS=1
-QUIC_PORTS=50000-65535
-
-MODE_HTTP=1
-MODE_HTTP_KEEPALIVE=0
-MODE_HTTPS=1
-MODE_QUIC=1
-MODE_FILTER=none
-
-DESYNC_MARK=0x40000000
-DESYNC_MARK_POSTNAT=0x20000000
-NFQWS_OPT_DESYNC="--dpi-desync=fake --dpi-desync-ttl=0 --dpi-desync-ttl6=0 --dpi-desync-fooling=badsum"
-NFQWS_OPT_DESYNC_HTTP="--dpi-desync=split --dpi-desync-ttl=5"
-NFQWS_OPT_DESYNC_HTTPS="--dpi-desync=fake --dpi-desync-ttl=5"
-NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake,tamper --dpi-desync-repeats=6 --dpi-desync-any-protocol"
-
-TPWS_OPT="--hostspell=HOST --split-http-req=method --split-pos=3 --hostcase --oob"
-
-FLOWOFFLOAD=donttouch
-
-INIT_APPLY_FW=1
-
-DISABLE_IPV6=1
-    '';
-  };
-}

nixos/modules/zapret/zapret_service.nix

@@ -1,127 +0,0 @@
-{
-  lib,
-  config,
-  pkgs,
-  ...
-}:
-
-with lib;
-
-let
-  cfg = config.services.zapret;
-in
-{
-  options.services.zapret = {
-    enable = mkEnableOption "DPI bypass multi platform service";
-
-    package = mkPackageOption pkgs "zapret" { };
-
-    settings = mkOption {
-      type = types.lines;
-      default = "";
-
-      example = ''
-        TPWS_OPT="--hostspell=HOST --split-http-req=method --split-pos=3 --oob"
-        NFQWS_OPT_DESYNC="--dpi-desync-ttl=5"
-      '';
-
-      description = ''
-        Rules for zapret to work. Run ```nix-shell -p zapret --command blockcheck``` to get values to pass here.
-        Config example can be found here https://github.com/bol-van/zapret/blob/master/config.default
-      '';
-    };
-
-    firewallType = mkOption {
-      type = types.enum [
-        "iptables"
-        "nftables"
-      ];
-      default = "iptables";
-      description = ''
-        Which firewall zapret should use
-      '';
-    };
-
-    disableIpv6 = mkOption {
-      type = types.bool;
-      # recommended by upstream
-      default = true;
-      description = ''
-        Disable or enable usage of IpV6 by zapret
-      '';
-    };
-
-    mode = mkOption {
-      type = types.enum [
-        "tpws"
-        "tpws-socks"
-        "nfqws"
-        "filter"
-        "custom"
-      ];
-      default = "tpws";
-      description = ''
-        Which mode zapret should use
-      '';
-    };
-  };
-
-  config = mkIf cfg.enable {
-    users.users.tpws = {
-      isSystemUser = true;
-      group = "tpws";
-    };
-
-    users.groups.tpws = { };
-
-    systemd.services.zapret = {
-      after = [ "network-online.target" ];
-      wants = [ "network-online.target" ];
-      wantedBy = [ "multi-user.target" ];
-
-      path = with pkgs; [
-        (if cfg.firewallType == "iptables" then iptables else nftables)
-        gawk
-        ipset
-      ];
-
-      serviceConfig = {
-        Type = "forking";
-        Restart = "no";
-        TimeoutSec = "30sec";
-        IgnoreSIGPIPE = "no";
-        KillMode = "none";
-        GuessMainPID = "no";
-        RemainAfterExit = "no";
-        ExecStart = "${cfg.package}/bin/zapret start";
-        ExecStop = "${cfg.package}/bin/zapret stop";
-
-        EnvironmentFile = pkgs.writeText "${cfg.package.pname}-environment" (concatStrings [
-          ''
-            MODE=${cfg.mode}
-            FWTYPE=${cfg.firewallType}
-            DISABLE_IPV6=${if cfg.disableIpv6 then "1" else "0"}
-          ''
-          cfg.settings
-        ]);
-
-        # hardening
-        DevicePolicy = "closed";
-        KeyringMode = "private";
-        PrivateTmp = true;
-        PrivateMounts = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectSystem = "strict";
-        ProtectProc = "invisible";
-        RemoveIPC = true;
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        SystemCallArchitectures = "native";
-      };
-    };
-  };
-}