feat(working): give each host its own unnic wireguard peer #61

Merged

marti merged 1 commit from feature/per-host-work-vpn into main

2026-10-27 10:00:08 +01:00

marti commented

2026-10-27 09:58:30 +01:00

Owner

Summary

Each host gets its own unnic WireGuard peer, so two machines can be on the work VPN at once. The module picks the secrets by hostname.

 unnic/wireguard/
-  priv
-  psk
+  cumwork/{priv, psk, address}    # the old peer, 10.8.0.4/24
+  cumputer/{priv, psk, address}   # new peer, 10.8.0.16/24

 profiles.unnic
-  private-key = shared priv
-  address1    = "10.8.0.4/24"
+  private-key = unnic/wireguard/<hostname>/priv
+  address1    = unnic/wireguard/<hostname>/address

To give another host the profile, add unnic/wireguard/<hostname>/{priv,psk,address} to the secrets and the working feature to that host.

Evidence

Before: cumwork and cumputer both used the same key and the same 10.8.0.4 address, so connecting one dropped the other.
After: each host's unnic-wireguard.env template points at its own sops entries. The sops manifests for cumputer and cumwork build, which means sops-nix found every key in .secrets.yaml. nix build --dry-run of the toplevel passes for cumputer, cumwork and cumpad.

Merge Danger

Door: two-way

Reverting restores the shared secret layout. The old key and PSK now sit under cumwork/, so nothing is lost.

Blast Radius: work-VPN

Only hosts with the working feature are affected (cumputer and cumwork). A host that gets working without its own sops entries fails at build time, not at runtime.

🤖 Generated with Claude Code

## Summary Each host gets its own unnic WireGuard peer, so two machines can be on the work VPN at once. The module picks the secrets by hostname. ```diff unnic/wireguard/ - priv - psk + cumwork/{priv, psk, address} # the old peer, 10.8.0.4/24 + cumputer/{priv, psk, address} # new peer, 10.8.0.16/24 ``` ```diff profiles.unnic - private-key = shared priv - address1 = "10.8.0.4/24" + private-key = unnic/wireguard/<hostname>/priv + address1 = unnic/wireguard/<hostname>/address ``` To give another host the profile, add `unnic/wireguard/<hostname>/{priv,psk,address}` to the secrets and the `working` feature to that host. ## Evidence - **Before:** cumwork and cumputer both used the same key and the same 10.8.0.4 address, so connecting one dropped the other. **After:** each host's `unnic-wireguard.env` template points at its own sops entries. The sops manifests for cumputer and cumwork build, which means sops-nix found every key in `.secrets.yaml`. `nix build --dry-run` of the toplevel passes for cumputer, cumwork and cumpad. ## Merge Danger **Door:** two-way Reverting restores the shared secret layout. The old key and PSK now sit under `cumwork/`, so nothing is lost. **Blast Radius:** work-VPN Only hosts with the `working` feature are affected (cumputer and cumwork). A host that gets `working` without its own sops entries fails at build time, not at runtime. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

marti added 1 commit

2026-10-27 09:58:31 +01:00

feat(working): give each host its own unnic wireguard peer 50a8af6880

Every machine shared one WireGuard identity, so only one of them could
be connected to the work VPN at a time. The keys and tunnel address now
live under unnic/wireguard/<hostname>/{priv,psk,address} and the module
picks them by hostname: cumwork keeps the old peer (10.8.0.4), cumputer
gets a new one (10.8.0.16).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

marti merged commit 81745bce89 into main

2026-10-27 10:00:08 +01:00

marti referenced this pull request from a commit

2026-10-27 10:00:08 +01:00

Merge pull request 'feat(working): give each host its own unnic wireguard peer' (#61) from feature/per-host-work-vpn into main

marti deleted branch feature/per-host-work-vpn

2026-10-27 10:00:10 +01:00