Skip to content

Commit 17c0934

Browse files
johnalotoskijohnalotoski
committed
r2 tunnel: adds devx-ci r2 wg tunnel to route around CF-ARN colo
1 parent 7ff0f9d commit 17c0934

File tree

4 files changed

+126
-3
lines changed

4 files changed

+126
-3
lines changed

‎.sops.yaml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ keys:
44

55
# Misc
66
- &misc1-metadata-a-1 age187hd0pffv549vfcmnw5u9yg3fck9e4psesz2xchrklqjqepccd7s6vlkcv
7+
- &misc1-wg-a-1 age1ryvlcaajedpnkdyugnre6yysht5ahkn3yrwz48wvywpn2sxwfqtqrc8qmn
78

89
# Preprod
910
- &preprod1-bp-a-1 age1zhewzr3r8u4qmu9c5asw0vv9pw9qxvah9y60reu5uggrr8vrd95skhn3q3
@@ -214,13 +215,20 @@ creation_rules:
214215
- *sre
215216
- *mainnet1-rel-a-1
216217

217-
# Miscellaneous group specific
218+
# Miscellaneous group specific, metadata server
218219
- path_regex: secrets/groups/misc1/deploy/.*metadata.*$
219220
key_groups:
220221
- age:
221222
- *sre
222223
- *misc1-metadata-a-1
223224

225+
# Miscellaneous group specific, wireguard tunnel
226+
- path_regex: secrets/groups/misc1/deploy/.*wg.*$
227+
key_groups:
228+
- age:
229+
- *sre
230+
- *misc1-wg-a-1
231+
224232
# Temporary buildkite testing
225233
- path_regex: secrets/buildkite/.*$
226234
key_groups:

‎flake/colmena.nix‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,7 @@ in
239239
imports = [
240240
config.flake.cardano-parts.cluster.groups.default.meta.cardano-node-service-ng
241241
config.flake.cardano-parts.cluster.groups.default.meta.cardano-tracer-service-ng
242-
config.flake.cardano-parts.cluster.groups.default.meta.cardano-db-sync-service
242+
config.flake.cardano-parts.cluster.groups.default.meta.cardano-db-sync-service-ng
243243
inputs.cardano-parts.nixosModules.profile-cardano-db-sync
244244
inputs.cardano-parts.nixosModules.profile-cardano-node-group
245245
inputs.cardano-parts.nixosModules.profile-cardano-custom-metrics
@@ -574,7 +574,7 @@ in
574574
map (n: mkContainer n (toString (10 - n))) (lib.range 1 count);
575575
};
576576
};
577-
#
577+
578578
# disableP2p = {
579579
# services.cardano-node = {
580580
# useNewTopology = false;
@@ -828,6 +828,7 @@ in
828828
# Misc
829829
misc1-metadata-a-1 = {imports = [eu-central-1 t3a-large (ebs 80) (group "misc1") metadata nixosModules.cardano-ipfs];};
830830
misc1-webserver-a-1 = {imports = [eu-central-1 t3a-medium (ebs 80) (group "misc1") webserver (varnishRamPct 50)];};
831+
misc1-wg-a-1 = {imports = [eu-central-1 t3a-medium (ebs 80) (group "misc1") nixosModules.wg-r2-tunnel];};
831832
# ---------------------------------------------------------------------------------------------------------
832833

833834
# ---------------------------------------------------------------------------------------------------------

‎flake/nixosModules/wg-r2-tunnel.nix‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
flake: {
2+
flake.nixosModules.wg-r2-tunnel = {
3+
name,
4+
config,
5+
pkgs,
6+
...
7+
}: let
8+
inherit (groupCfg) groupName groupFlake;
9+
inherit (opsLib) mkSopsSecret;
10+
11+
groupOutPath = groupFlake.self.outPath;
12+
groupCfg = config.cardano-parts.cluster.group;
13+
opsLib = flake.config.flake.cardano-parts.lib.opsLib pkgs;
14+
in {
15+
environment.systemPackages = [pkgs.wireguard-tools];
16+
17+
networking = {
18+
nat = {
19+
enable = true;
20+
externalInterface = "ens5";
21+
internalInterfaces = ["wg0"];
22+
};
23+
24+
firewall.allowedUDPPorts = [config.networking.wireguard.interfaces.wg0.listenPort];
25+
26+
wireguard = {
27+
enable = true;
28+
interfaces.wg0 = {
29+
privateKeyFile = "/run/secrets/wireguard";
30+
listenPort = 51820;
31+
32+
# Assign the build machines in the remote farm with their existing
33+
# wg0 interface assigned IP from the devx-ci repo: "10.100.0.X" where
34+
# X = the numbered suffix in the name, ex: ci1, ci2, ...
35+
ips = ["10.254.0.254"];
36+
peers = [
37+
# Linux builders
38+
{
39+
name = "ci1";
40+
allowedIPs = ["10.100.0.1/32"];
41+
publicKey = "52aw4lh3H+x4fXdry2vzZ0yQ/TzmHmG5JTc61/Fu/mM=";
42+
persistentKeepalive = 25;
43+
}
44+
{
45+
name = "ci2";
46+
allowedIPs = ["10.100.0.2/32"];
47+
publicKey = "XF90HyfTTlDJ+8V+L0vRpD/mLYal/6vWUdjXXhauUxQ=";
48+
persistentKeepalive = 25;
49+
}
50+
{
51+
name = "ci3";
52+
allowedIPs = ["10.100.0.3/32"];
53+
publicKey = "SLFctAtZXGCQ8BPfy1aivR7IHXwypjJgTvIXIwKxamY=";
54+
persistentKeepalive = 25;
55+
}
56+
{
57+
name = "ci4";
58+
allowedIPs = ["10.100.0.4/32"];
59+
publicKey = "5B981U7qiMXtuoCfyzY9vyhR953cwcLl6Onx21qPrVo=";
60+
persistentKeepalive = 25;
61+
}
62+
{
63+
name = "ci5";
64+
allowedIPs = ["10.100.0.5/32"];
65+
publicKey = "+ek1olvdILegvVCDCmmUJk+f0N0VQu48Ha4XTyw3Wz0=";
66+
persistentKeepalive = 25;
67+
}
68+
{
69+
name = "ci6";
70+
allowedIPs = ["10.100.0.6/32"];
71+
publicKey = "tSWXADCEKG2yz2Cm4OB6AQRPW22ofuywOYFjfYZt328=";
72+
persistentKeepalive = 25;
73+
}
74+
75+
# Hydra
76+
{
77+
name = "ci9";
78+
allowedIPs = ["10.100.0.9/32"];
79+
publicKey = "gGRNt3nw9Dt5Yoi0nK4G81UNeLMGMDw/QuZX6b0kQig=";
80+
persistentKeepalive = 25;
81+
}
82+
];
83+
};
84+
};
85+
};
86+
87+
sops.secrets = mkSopsSecret {
88+
secretName = "wireguard";
89+
keyName = "${name}-wireguard";
90+
inherit groupOutPath groupName;
91+
fileOwner = "root";
92+
fileGroup = "root";
93+
};
94+
};
95+
}

‎secrets/groups/misc1/deploy/misc1-wg-a-1-wireguard‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"data": "ENC[AES256_GCM,data:tK5aBL1IDYXGFZm5XxHy6rKBmDWqnYjwg9QYzkX9LFv8qyfVxIlNGZq7czE=,iv:5B+kYr07j9Mzhol5gtSpAMhzbi4QY4xSRShRH3lAIpY=,tag:ZauUQyCD5/ERwtiQC5OXNQ==,type:str]",
3+
"sops": {
4+
"age": [
5+
{
6+
"recipient": "age1rj7vaq0rsarnum2fx6zq0k3l64f6mca9t9mlhqu4nfvpqhux6uts5zud2m",
7+
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0TEdrc3Uwcm1zcVJycGVv\nUmFiaGViV2ZDS3hlYWszN0JyR0xibDFDTGc4CllFZWEvWmJBb3JCc2JuckhlL2VP\na0J5WENTbEZyZjdoZEd2eU5hTFJlSUkKLS0tIHRkRjZhcEhQTnhodmh6Z2RpUzhL\nY0dTVGRPOC9DYjFoMm54Nk9LNkVUclkKLkRTq9sgG5w7EyRu1EogQx3jqmN+rWla\nzcW4zfUyRdaSsqzAabUrn9tOrVRuNKnn8wwFl54xcEiB3VDEptxG6w==\n-----END AGE ENCRYPTED FILE-----\n"
8+
},
9+
{
10+
"recipient": "age1ryvlcaajedpnkdyugnre6yysht5ahkn3yrwz48wvywpn2sxwfqtqrc8qmn",
11+
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6ME11NnJBSS9PS0ltMVVZ\nU0owSW1wNU1xSDUzYUNCQVQ1R1F5UitvVTFvClhDLzU0QnJtVzVDSjBXREYvNDJE\nOTR2VFZDVFo2OThuZnlYQmEyVU94R1kKLS0tIDRKSzN2R3RLMlROeUJVTXVWZFBT\nUDhmOU5JVTZodnU5d1p4MXJCbFJKNUUK+c1kmj03HrRHbzITLE4/Y3nSmrcowGMT\nMGUhL0EqCmnVLJGkCH9i1iQlwVrVKiDzfjbN6yueLpoIgUq+Prz56w==\n-----END AGE ENCRYPTED FILE-----\n"
12+
}
13+
],
14+
"lastmodified": "2025-09-11T17:58:15Z",
15+
"mac": "ENC[AES256_GCM,data:XD5SBiEp/W1RihU1L0mHuh/Up5V+gueqizU+XXsUA0rkeJGJGqK+SHjGwt23LJajEfxkIY0x5tn8tiCRGs1fLCu7+WmCQC4BxcHM8YkIKFueVVFn3e7khCZgmIHsz0ThmB+529l3PFCJAthUJAS7qhu1ELeeNm+5m4svJMoUwio=,iv:Nd9b+zHUcR7N1rCsy84EGauHuDXmKJFI1kz+NGF7Cw4=,tag:X1UD0bQ9yh20c6VRXjWdMA==,type:str]",
16+
"unencrypted_suffix": "_unencrypted",
17+
"version": "3.10.2"
18+
}
19+
}

0 commit comments

Comments
 (0)