From bb2c3345a00a5745692cda1b865572fa0574ea2b Mon Sep 17 00:00:00 2001
From: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>
Date: Fri, 19 Sep 2025 13:27:42 +0200
Subject: [PATCH] Add raccoon peer to wireguard

---
 m/apex/wireguard.nix        |   6 ++++++
 m/fox/wireguard.nix         |   6 ++++++
 m/raccoon/configuration.nix |   1 +
 m/raccoon/wireguard.nix     |  39 ++++++++++++++++++++++++++++++++++++
 secrets/secrets.nix         |   2 ++
 secrets/wg-raccoon.age      | Bin 0 -> 697 bytes
 6 files changed, 54 insertions(+)
 create mode 100644 m/raccoon/wireguard.nix
 create mode 100644 secrets/wg-raccoon.age

diff --git a/m/apex/wireguard.nix b/m/apex/wireguard.nix
index 0a6ac5f0..6cb42bb7 100644
--- a/m/apex/wireguard.nix
+++ b/m/apex/wireguard.nix
@@ -25,11 +25,17 @@
           # Send keepalives every 25 seconds. Important to keep NAT tables alive.
           persistentKeepalive = 25;
         }
+        {
+          name = "raccoon";
+          publicKey = "QUfnGXSMEgu2bviglsaSdCjidB51oEDBFpnSFcKGfDI=";
+          allowedIPs = [ "10.106.0.236/32" ];
+        }
       ];
     };
   };
 
   networking.hosts = {
     "10.106.0.1" = [ "fox" ];
+    "10.106.0.236" = [ "raccoon.wg" ];
   };
 }
diff --git a/m/fox/wireguard.nix b/m/fox/wireguard.nix
index d0b4349e..d5b4e414 100644
--- a/m/fox/wireguard.nix
+++ b/m/fox/wireguard.nix
@@ -29,12 +29,18 @@
           # List of IPs assigned to this peer within the tunnel subnet. Used to configure routing.
           allowedIPs = [ "10.106.0.30/32" ];
         }
+        {
+          name = "raccoon";
+          publicKey = "QUfnGXSMEgu2bviglsaSdCjidB51oEDBFpnSFcKGfDI=";
+          allowedIPs = [ "10.106.0.236/32" ];
+        }
       ];
     };
   };
 
   networking.hosts = {
     "10.106.0.30" = [ "apex" ];
+    "10.106.0.236" = [ "raccoon.wg" ];
   };
 
   networking.firewall = {
diff --git a/m/raccoon/configuration.nix b/m/raccoon/configuration.nix
index cec17e6f..7a608e20 100644
--- a/m/raccoon/configuration.nix
+++ b/m/raccoon/configuration.nix
@@ -8,6 +8,7 @@
     ../module/ssh-hut-extern.nix
     ../module/nvidia.nix
     ../eudy/kernel/perf.nix
+    ./wireguard.nix
   ];
 
   # Don't install Grub on the disk yet
diff --git a/m/raccoon/wireguard.nix b/m/raccoon/wireguard.nix
new file mode 100644
index 00000000..31f7d699
--- /dev/null
+++ b/m/raccoon/wireguard.nix
@@ -0,0 +1,39 @@
+{ config, ... }:
+
+{
+  networking.firewall = {
+    allowedUDPPorts = [ 666 ];
+  };
+
+  age.secrets.wgRaccoon.file = ../../secrets/wg-raccoon.age;
+
+  # Enable WireGuard
+  networking.wireguard.enable = true;
+  networking.wireguard.interfaces = {
+    wg0 = {
+      ips = [ "10.106.0.236/24" ];
+      listenPort = 666;
+      privateKeyFile = config.age.secrets.wgRaccoon.path;
+      # Public key: QUfnGXSMEgu2bviglsaSdCjidB51oEDBFpnSFcKGfDI=
+      peers = [
+        {
+          name = "fox";
+          publicKey = "VfMPBQLQTKeyXJSwv8wBhc6OV0j2qAxUpX3kLHunK2Y=";
+          allowedIPs = [ "10.106.0.1/32" ];
+          endpoint = "fox.ac.upc.edu:666";
+        }
+        {
+          name = "apex";
+          publicKey = "VwhcN8vSOzdJEotQTpmPHBC52x3Hbv1lkFIyKubrnUA=";
+          allowedIPs = [ "10.106.0.30/32" ];
+          endpoint = "ssfhead.bsc.es:666";
+        }
+      ];
+    };
+  };
+
+  networking.hosts = {
+    "10.106.0.1"  = [ "fox.wg" ];
+    "10.106.0.30" = [ "apex.wg" ];
+  };
+}
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 96732490..920d52dc 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -4,6 +4,7 @@ let
   hut = [ keys.hosts.hut ] ++ adminsKeys;
   fox = [ keys.hosts.fox ] ++ adminsKeys;
   apex = [ keys.hosts.apex ] ++ adminsKeys;
+  raccoon = [ keys.hosts.raccoon ] ++ adminsKeys;
   mon = [ keys.hosts.hut keys.hosts.tent ] ++ adminsKeys;
   tent = [ keys.hosts.tent ] ++ adminsKeys;
   # Only expose ceph keys to safe nodes and admins
@@ -29,4 +30,5 @@ in
 
   "wg-fox.age".publicKeys = fox;
   "wg-apex.age".publicKeys = apex;
+  "wg-raccoon.age".publicKeys = raccoon;
 }
diff --git a/secrets/wg-raccoon.age b/secrets/wg-raccoon.age
new file mode 100644
index 0000000000000000000000000000000000000000..f32a2aa395b4fcaf3bdd9cf09e9164d3a85aad62
GIT binary patch
literal 697
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+k2J4zFIR|6%-1f>
zv~&&3NvX<kaVrSU4azIbv`C9G^9t7vjr2?nO)<61$VhW759A6+_09@P$<faZcFs2P
z4a#s&^$ZBe%X7&Mb}B6^3#c%#a7nDnb9FOI&PTT`+1oVRqg=rt+@s3f%h@a3CEKDh
zz#_RcDI;4uFDojl%CjIWr`#_$BgeTQJ-D#ID4naK%CJ1iETE(;$iyhq)YZ2z!l$&<
zusF%Y*QqeltH8~;%s3;@BGWS~)CAo&XUA}NlR$+aV^g;hU*~jp|D2TKk_wM9vlK_u
z{G`$h%Y6O33VrQFce9k@WMjkRa$hcs%urW%=R)lyOY<O)0DrFtw-g^sOUtMn?TjKv
z6O*d&G86y&u-stF$WV0KDjdy?EgcmM3yYi#j4}$#{9PlG^dlqFQ$w9R979VZolE`F
z^MWb@k}|?P!VS_RolUsHveR;%%_|a1eKVXh^CEnT!b8kcy|mp-3*0=6Ey5fF%iJ>q
zasr)vT*}dH^9^=0PDxiN@bs!Q)HgHBHIFa~^A9mF&P(%34GD+}Eet9v_Y4ltD+@Mr
zb`J}33U%djF0TwU^SAITuME%eu88#T^UY7qa7@qf4Jh|4s>lrqH_fx~4@&e7^~vYb
z)zwvqsL1j)cPk7iGxA8z$cPNfH8R)s@yjgD^$066vh)nfa5nVL&oinjuJq)3z`xP`
zd5>n%_lLzsEWg+^*k+4KKA2?7U}x?pD<ZjOL+_I<A-qZIcW)}#{E2D{YsmZf^LoI}
caF*4t47T@LU)j<0dSma8BJPz1n(TJ#0lf(6`v3p{

literal 0
HcmV?d00001