Wireguard

23 files changed, 263 insertions, 74 deletions

diff --git a/home/default.nix b/home/default.nix
index 6ed7cb7..e8b74a9 100644
--- a/home/default.nix
+++ b/home/default.nix
@@ -522,6 +522,9 @@ in
     ssh = {
       enableDefaultConfig = false;
       enable = true;
+      matchBlocks."relesoft.io" = {
+        hostname = "65.21.238.221";
+      };
       matchBlocks."*" = {
         compression = true;
         controlMaster = "auto";
diff --git a/hosts/kataja/default.nix b/hosts/kataja/default.nix
index d7be404..d04128f 100644
--- a/hosts/kataja/default.nix
+++ b/hosts/kataja/default.nix
@@ -122,5 +122,53 @@
     bluetooth.settings.General.Name = "kataja";
   };
 
+  age.secrets.wg_relesoft = {
+    file = ../../secrets/wg_relesoft_kataja.age;
+    group = "systemd-network";
+    mode = "0640";
+  };
+
+  systemd.network.netdevs."90-wg-relesoft" = {
+    netdevConfig = {
+      Name = "wg-relesoft";
+      Kind = "wireguard";
+    };
+    wireguardConfig = {
+      PrivateKeyFile = config.age.secrets.wg_relesoft.path;
+    };
+    wireguardPeers = [
+      {
+        PublicKey = "B5QK7rl8sAXPu2upKhondWSt49qMOqTG/hDjwqY3cDs=";
+        Endpoint = "65.21.238.221:51194";
+        AllowedIPs = [
+          "10.200.200.0/24"
+          "fdc9:281f:4d7:9ee9::/64"
+          "2a01:4f9:6a:4e26::/64"
+        ];
+        PersistentKeepalive = 25;
+      }
+    ];
+  };
+
+  systemd.network.networks."90-wg-relesoft" = {
+    matchConfig.Name = "wg-relesoft";
+    address = [
+      "10.200.200.12/24"
+      "fdc9:281f:4d7:9ee9::12/128"
+      "2a01:4f9:6a:4e26::12/128"
+    ];
+    networkConfig = {
+      IPv4Forwarding = true;
+      IPv6Forwarding = true;
+      IPv6AcceptRA = false;
+    };
+    routes = [
+      { Destination = "10.200.200.0/24"; }
+      { Destination = "fdc9:281f:4d7:9ee9::/64"; }
+      { Destination = "2a01:4f9:6a:4e26::/64"; }
+    ];
+    linkConfig.MTUBytes = "1420";
+  };
+
   system.stateVersion = "25.11";
 }
diff --git a/hosts/pihlaja/default.nix b/hosts/pihlaja/default.nix
index 54a7efd..fd0a1b1 100644
--- a/hosts/pihlaja/default.nix
+++ b/hosts/pihlaja/default.nix
@@ -230,5 +230,53 @@
     });
   '';
 
+  age.secrets.wg_relesoft = {
+    file = ../../secrets/wg_relesoft_pihlaja.age;
+    group = "systemd-network";
+    mode = "0640";
+  };
+
+  systemd.network.netdevs."90-wg-relesoft" = {
+    netdevConfig = {
+      Name = "wg-relesoft";
+      Kind = "wireguard";
+    };
+    wireguardConfig = {
+      PrivateKeyFile = config.age.secrets.wg_relesoft.path;
+    };
+    wireguardPeers = [
+      {
+        PublicKey = "B5QK7rl8sAXPu2upKhondWSt49qMOqTG/hDjwqY3cDs=";
+        Endpoint = "65.21.238.221:51194";
+        AllowedIPs = [
+          "10.200.200.0/24"
+          "fdc9:281f:4d7:9ee9::/64"
+          "2a01:4f9:6a:4e26::/64"
+        ];
+        PersistentKeepalive = 25;
+      }
+    ];
+  };
+
+  systemd.network.networks."90-wg-relesoft" = {
+    matchConfig.Name = "wg-relesoft";
+    address = [
+      "10.200.200.10/24"
+      "fdc9:281f:4d7:9ee9::10/128"
+      "2a01:4f9:6a:4e26::10/128"
+    ];
+    networkConfig = {
+      IPv4Forwarding = true;
+      IPv6Forwarding = true;
+      IPv6AcceptRA = false;
+    };
+    routes = [
+      { Destination = "10.200.200.0/24"; }
+      { Destination = "fdc9:281f:4d7:9ee9::/64"; }
+      { Destination = "2a01:4f9:6a:4e26::/64"; }
+    ];
+    linkConfig.MTUBytes = "1420";
+  };
+
   system.stateVersion = "24.05"; # Did you read the comment?
 }
diff --git a/hosts/saarni/default.nix b/hosts/saarni/default.nix
index 5043657..49b37ea 100644
--- a/hosts/saarni/default.nix
+++ b/hosts/saarni/default.nix
@@ -150,5 +150,53 @@
     };
     thermald.enable = true;
   };
+  age.secrets.wg_relesoft = {
+    file = ../../secrets/wg_relesoft_saarni.age;
+    group = "systemd-network";
+    mode = "0640";
+  };
+
+  systemd.network.netdevs."90-wg-relesoft" = {
+    netdevConfig = {
+      Name = "wg-relesoft";
+      Kind = "wireguard";
+    };
+    wireguardConfig = {
+      PrivateKeyFile = config.age.secrets.wg_relesoft.path;
+    };
+    wireguardPeers = [
+      {
+        PublicKey = "B5QK7rl8sAXPu2upKhondWSt49qMOqTG/hDjwqY3cDs=";
+        Endpoint = "65.21.238.221:51194";
+        AllowedIPs = [
+          "10.200.200.0/24"
+          "fdc9:281f:4d7:9ee9::/64"
+          "2a01:4f9:6a:4e26::/64"
+        ];
+        PersistentKeepalive = 25;
+      }
+    ];
+  };
+
+  systemd.network.networks."90-wg-relesoft" = {
+    matchConfig.Name = "wg-relesoft";
+    address = [
+      "10.200.200.11/24"
+      "fdc9:281f:4d7:9ee9::11/128"
+      "2a01:4f9:6a:4e26::11/128"
+    ];
+    networkConfig = {
+      IPv4Forwarding = true;
+      IPv6Forwarding = true;
+      IPv6AcceptRA = false;
+    };
+    routes = [
+      { Destination = "10.200.200.0/24"; }
+      { Destination = "fdc9:281f:4d7:9ee9::/64"; }
+      { Destination = "2a01:4f9:6a:4e26::/64"; }
+    ];
+    linkConfig.MTUBytes = "1420";
+  };
+
   system.stateVersion = "24.05";
 }
diff --git a/hosts/tammi/90-wg-relesoft.netdev b/hosts/tammi/90-wg-relesoft.netdev
new file mode 100644
index 0000000..9ef2e1e
--- /dev/null
+++ b/hosts/tammi/90-wg-relesoft.netdev
@@ -0,0 +1,15 @@
+[NetDev]
+Name=wg-relesoft
+Kind=wireguard
+Description=WireGuard tunnel to relesoft.io
+
+[WireGuard]
+PrivateKey=KG00ekUKe0NFxuP3ndV0EZUtKX4wR8iyU+0rufZGuFA=
+
+[WireGuardPeer]
+PublicKey=B5QK7rl8sAXPu2upKhondWSt49qMOqTG/hDjwqY3cDs=
+Endpoint=65.21.238.221:51194
+AllowedIPs=10.200.200.0/24
+AllowedIPs=fdc9:281f:04d7:9ee9::/64
+AllowedIPs=2a01:4f9:6a:4e26::/64
+PersistentKeepalive=25
diff --git a/hosts/tammi/90-wg-relesoft.network b/hosts/tammi/90-wg-relesoft.network
new file mode 100644
index 0000000..5ba120b
--- /dev/null
+++ b/hosts/tammi/90-wg-relesoft.network
@@ -0,0 +1,23 @@
+[Match]
+Name=wg-relesoft
+
+[Link]
+MTUBytes=1420
+
+[Network]
+Address=10.200.200.13/24
+Address=fdc9:281f:04d7:9ee9::13/128
+Address=2a01:4f9:6a:4e26::13/128
+IPv4Forwarding=yes
+IPv6Forwarding=yes
+IPv6AcceptRA=no
+LinkLocalAddressing=no
+
+[Route]
+Destination=10.200.200.0/24
+
+[Route]
+Destination=fdc9:281f:04d7:9ee9::/64
+
+[Route]
+Destination=2a01:4f9:6a:4e26::/64
diff --git a/roles/shared.nix b/roles/shared.nix
index 99c4845..483f45b 100644
--- a/roles/shared.nix
+++ b/roles/shared.nix
@@ -343,6 +343,7 @@
       shaderc.static
       sshpass
       busybox
+      wireguard-tools
       vulkan-headers
       vulkan-loader
       vulkan-tools
diff --git a/secrets/duckdns_login_token.age b/secrets/duckdns_login_token.age
index 3b3d3ab..a519b33 100644
--- a/secrets/duckdns_login_token.age
+++ b/secrets/duckdns_login_token.age
@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 egf4NA +VzAzKhuXkw74GBIOzofN6/6SI7cje4aiEcDZDxEclg
-e325gmTDa+fvp/AgdxyQYv2071Err/kgtnHq67LHHhE
--> ssh-ed25519 nivnYg Hm2IQ/VYz/+IeZfkeQYwedpuI5n7ud2kxggBJoPx8As
-DQjHPv+RCrlP8dF6rJlRF8y6DcE71E/0sWD2cy1vf50
--> ssh-ed25519 SIk9MQ dOGiCPHx48roHubeG080IiMK4qhlMFoQG2dzfXyOP1A
-P2Q/80buYQo18MLG6RhW3RZqrxn1pk9Yvn98AUll7UU
---- Q3ykV4uJZ7W3A2zOzZGbcFIBNo8s9TB+jZMKmGqtZoY
-
�O�����ܿ[w_j�A��UŔHf���kSx�K�/\{Ϙ���1
�f���N^�i`Vps�eAQ
\ No newline at end of file
+-> ssh-ed25519 egf4NA F4GBfNpWG75ESy176wtm+vLHcSdAa9ZdbnwXubNkuiM
+ccX1/Z0dTvwd8iyavC0k1Z2ppWuNkc8bEmyTVA5BNHs
+-> ssh-ed25519 nivnYg o/UjkIgc1o6UV07FtzFS7paHKyskSVhe7kEcEk527Bk
+1zKLbNGq++UN6+/80XbyeGoukHF1oYhE+fHCl2NPe14
+-> ssh-ed25519 SIk9MQ Wbn0cKs1CjjxptJ06hG4aGo7qJO0tw2ammLfADOor0M
+CSbdt4f43d8XLf8hPnCtGZ4cd7kLVs9NU99uu0/g16U
+--- UL6LnkmstsoTzmenzOOAWjAZxvFtKYmHo8ncWCaq59o
+>�O�³,fO@i��%�;6�s�w�{���~��7��ֶ�hx?����(#�c
�M�^��(W���e]q�
\ No newline at end of file
diff --git a/secrets/forgejo.age b/secrets/forgejo.age
index e57b11c..f7a0bb2 100644
--- a/secrets/forgejo.age
+++ b/secrets/forgejo.age
@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 egf4NA 3QsGsfV3HjIyiAjYS2pHn8XS+QVqHjJyeyXCWOVxmiE
-cRwdpYAOxGISDqczCeF8263bCAUKzHaCl+uOCf6ofIA
--> ssh-ed25519 nivnYg yq5CQdmIndZ/w1QfHUR4uSNh7yyq4nfOgLs3FmcWKhc
-fx28Vj/Fmgllrw2lNKUqWP8WbkOEioibbI8tqh82sd8
--> ssh-ed25519 SIk9MQ W+8sFOxyaoQpupYA9/mzMwnpn8DyOhF/e+ecOJ0kDwU
-NcX6MgEOfwBHnzLVFCMnk1fXaUR05pos8fYPeKWfO7E
---- L/KB6Xd+wa19ldkEGaDOXj9yMSU/2CndF6muUmGaQhU
-W�8�zR������Ø+De�]�t�/V#=�^�۵�q���k?�zg�����B����^j-#S-��Ϫn
\ No newline at end of file
+-> ssh-ed25519 egf4NA KF2j3N0OIRo30p04Oy0Po09fyqEFV4WXjl9i9nHyqzY
+ODRKAHZsGw1AxC3AI7SpohYJYYel1YAK3fteq4AQ4EI
+-> ssh-ed25519 nivnYg uhgBMrm1sNgrr/LiEp3jqAWCrllOIW5NG4ZfZjFuFXY
+Plk0RBv91mt8rH4b6ndyb9xLxSvzxonQ66Q6FC2C+fE
+-> ssh-ed25519 SIk9MQ E47QYLcULldBBtf0Y0i1VuVN9LRegKQamt55QQaSFGg
+cCXYPgRwkD3VApe3+3B81kFO5S1gAYkti7cw3ZGMTeo
+--- 0R9QYtbBxtyrCvDMiE9oUPny8vnd2xlPrZYJh0Sa/Jc
+�A�	�xY�1��&P5#�&���	�4�J��:c�1.&�o-�����3Z�}6z��QO��yCN_�(�	
\ No newline at end of file
diff --git a/secrets/gmail.age b/secrets/gmail.age
index f9a3540..2b58ea4 100644
--- a/secrets/gmail.age
+++ b/secrets/gmail.age
@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 SIk9MQ tG2XMK92K0BS4+6D/7f2FFnhx/XFcn0bc0qryrLZnkI
-Dbl424Y2izE9qTENo0oC+KA7arK3jxs1sCmolpO7L4I
--> ssh-ed25519 nivnYg xhC2zowQQPKWIJFphgHCWK6Fv3or4gEWMmrq+Xt+wl4
-6PoyXh+MZ3uL9eds8R2w50o9qb+i0elB7eunKMzJImE
--> ssh-ed25519 egf4NA hceSfAb5vAGGor4zXLtQQrD64HygN13KTye6b58BFT0
-ua1LO4Y7gYhNhMGJ9nAG/f0OtQw7WygPoUsIGKTLee0
---- AtIO61YC+CUcWLsk/3d8QiCOJo5NTnIn78cFg0MMiNg
-��^�ؙ��0�4�ɭF�D��c봮���D�'('����ჲJk
\ No newline at end of file
+-> ssh-ed25519 egf4NA 4y0WCYvt6amVUxLhJTzFZVGHn8jf7pFRt0YYWbRiFSE
+PL/sH2OfL12vEkpm8QPQhsIuSJN5mnT6qAHZlnw/NgM
+-> ssh-ed25519 nivnYg dd0J0aDLmjVk08o9dstEVYVuRpjKYwJV3CCCijwQrQk
+YWQtF9rEgnt+THxUDX52a2WpzwuAFoFDeV9ALoxyTHg
+-> ssh-ed25519 SIk9MQ CAtI/OR6n9M/yMbraxceXARt9+iJJQufWoP0EPB9FRc
+6KWjll0XkdKnIm7kDgaBbnwRa6NGFm5wuqa5zViMjXg
+--- r/1Slgr5qRP7pwn4EYcTRi0NnJN5+ztboMOCpzqtu3o
+%H����_��^�C�+��g]c=�
j󹺠��^�?ƀ/K�^
\ No newline at end of file
diff --git a/secrets/miniflux_api_key.age b/secrets/miniflux_api_key.age
index 2f53644..7f6d1ef 100644
--- a/secrets/miniflux_api_key.age
+++ b/secrets/miniflux_api_key.age
@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 SIk9MQ BRp0yTco5Q4sOac5hFEUhBjaHppmvCTbXlduXRfJAjM
-/tzdOv1JdMS/+wPEG14Os2e+msjTB0kE/BPBrCWeCUc
--> ssh-ed25519 egf4NA wLPwP/TzjstOjWp0YuM0qbPfjXBfW6vzI9RY6Kj3X2g
-XjjDmWVo9I+cat4FnEIAiyOwXe5aG0AJW65m++Elby0
--> ssh-ed25519 nivnYg 20vbXcFIy2mHpfVdwu/cQWydnJ4VGrETDEs1sjiKQD4
-x6dD/2btPNAyEU1oNFiBkLw9+I1bqU88NzJSuE0RNyI
---- xFZP/xTVMWe4RwhNB+RyjcNrkwVEPNpnzExx5uNuiOw
-���������2$�|*)�����l���P<ɢ��i/d��R��z�Z�f{��t����҃4ŚAD&����ړ
\ No newline at end of file
+-> ssh-ed25519 egf4NA J1/isdjmVYODu8vYajwuf4cWveg3qUDoeNum+voIa10
+5ELr2bAh22Gx3MOQen7kvq4LqFiE6INvevbGPCBwrFY
+-> ssh-ed25519 nivnYg LqrX1C6oO3ant80apWqEYbMXSrFMw+Uk3teIsH0h+TU
+Vf2DnuOWaYg3DSv2+2hQCb46tWGXLeKBSgcppU4pqa4
+-> ssh-ed25519 SIk9MQ WqDklPr2gcdpwt9yYsnRj5aYQIPfOJaqY21KwV2NRQw
+RJjlSlAqHN8720auLBO/wx6PR2KNC4gxbhNsFjA+ulw
+--- /rfsyVbT4DxpqFczDKDcD/4W3RCZvlZ8rWyPbAMgBCU
+�3:[�[ȝMz�(֪f�VӉ�KJ���Dü_1]2᧓�+���w�3}ڭ��Š�ۂ���O_h��*�/�\C�N
\ No newline at end of file
diff --git a/secrets/minio.age b/secrets/minio.age
index d063e42..64be5ae 100644
--- a/secrets/minio.age
+++ b/secrets/minio.age
@@ -1,10 +1,11 @@
 age-encryption.org/v1
--> ssh-ed25519 egf4NA 8lW1RHtykR+6pj9Ug2ZNnmSu254uTaDAt76+RRxkGz4
-NgEqN4TQ0GQxQ5pIPI0pEIFUrITcfSPeWyQu2A+Walc
--> ssh-ed25519 nivnYg 9cfMyQwHWrSza4S/r+b8TnXSzK/vkVTvmSEWmy3+HmM
-ALTBX4sQEgQk2qO+jQsryI1EsMRo5RV6oW+SC52Yilg
--> ssh-ed25519 SIk9MQ rAd4JXWDWTuJjhgXwF/eoe+4BRQ62MqQh7kmkkh2z1M
-z8vCOjNtDop28C4R0ZKvrsOdO+ngMtJRfnr3t//kV7k
---- yyneI1nvquyB252DjPsh1/5KuzPNTTofJf3Y4Opw+8A
-y�EY`���$��Su.�ϔ$�
�I:�t*`T���:�o��l���-~��@���d�O��e5�W+;*���}YiXTQ�bqt2s�r�-X��>��Mf�lµv���M���d��&��%�o���1�,ؾ*��!�Ѭ���#������;ޕJC��)
����j/�c8}@�A���L��������]1��')��g
�fO+�^3C�(���mlH9
-}�C�ʌ��\!����>�tYIe
�CE�����0��."�~v��]]��_B-�
�$�㝄W������hvB���ۚOx������ۓ���*T���F^L�{��1x�����|����>���ı�W�E��4�Z�$]Ȝ�WB�D��$j;{3�HWG�N
���C�F[(�8SV"\�-���&�0�����^��_��VS��	S�
\ No newline at end of file
+-> ssh-ed25519 egf4NA 3bNlkpiog2iIucIEdILts/x9O2sLMDEHVy4OMYPdlSs
+vM5TAVmF8wLe5/zg6Op31rYJe3c0wkp4G4YPG0dvqfY
+-> ssh-ed25519 nivnYg P2zBhRytEwBP0VpXTsro6e3lmPRQm9YAeY7KgKCoiXA
+WC/K/fln22YJzjL61eHVGjTwNo6qKLfN5/sGvXkh2H0
+-> ssh-ed25519 SIk9MQ D2JuX7SDkPvwbyOlObjXq8URfKNmsxAxP7LkXxg+Z3E
+vEG+yQI4Btlt37tFn+wksml1olF2jv6KR14+iOYL2xM
+--- G1OekzdserTkSAIkZRSuwGSPapYn3j+aIH72acrCyEA
+Hj�.���kȫ�z�,Q"㖕�ΟUR��i�����w��VwK~�
+b�=�S�;��$tg�[5]�؊�0)JT�������+����˧:�L�YW�k�����CxӺ��!u
+�oy;|���;I&�3��o�'��c�@�Ӯb�TTX����s="����F~�l�O����x'c�]W�0��>^���G�
=�����ԯW�o,;#�ܮ��.e��/K0u�G�/����;����
����H �S{Y��]
ǶF(�f�ѾWR=`��;�<2��OǷr�M~��
��{���,�
|�]<
 WS}�:|��!i*	����g����AV�E�Wt�?8�G��?�„T��)����S������E��ۉ�a�쌊(-t�w�P���U�ݯd���$���@������/a�.���Ra��D
\ No newline at end of file
diff --git a/secrets/openai_auth_token.age b/secrets/openai_auth_token.age
index 0573d6d..9113963 100644
--- a/secrets/openai_auth_token.age
+++ b/secrets/openai_auth_token.age
diff --git a/secrets/radicale.age b/secrets/radicale.age
index d7afaef..ccba4c9 100644
--- a/secrets/radicale.age
+++ b/secrets/radicale.age
@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 egf4NA t8xybeKMCRerg7jl8qtnO56gHokOKkp49r90AC5u0yQ
-aDh4inNR0BmhgaJ0IKQklIyfSAPXiwCqzFbqiY3JCcs
--> ssh-ed25519 nivnYg Jn3xfhyeClezWLJT6JCRFQOY3yWGjz2sw16OQ0zQUSM
-HbaxFg7AYjb24+pd3Qh1zUD6JVZoVdbZZWSNQYe5pg0
--> ssh-ed25519 SIk9MQ HXpzdz/crBh/9ZfKKf/ENJdnPh8Gjh9A6xKv7Eg/L0k
-Wjce2VTyDRw68uILHcUFkhIPhKoSyHZSh/D+pblGWC4
---- ZvNeXC8WWrupOsb6l/dJpFdCyXTDFXokleoaVOfgJu4
-݄�R@䨩6��B��1���̀$J$2�Z}</�V���) 
\ No newline at end of file
+-> ssh-ed25519 egf4NA vbYZkUQBOA2VjxRvk1HE0jfVmzCz0e3F9A1uuKze7gI
+QIuoACzyrk/KPjIStmEmjY5Y+6oHX339tM3mQRYxSmw
+-> ssh-ed25519 nivnYg gYnoUlcgaNcE0wW5u3B0a2Sfmr5ptP9V8FTeGjD7HUM
+136xY6Jl0THLt0ot0KTDVoeZv8Zbx9wHg4s1c8/hMu0
+-> ssh-ed25519 SIk9MQ Bq0eiRmfPCwIYf41WdXX5gb+QyAlDauyy6JkSO2ol3c
+twVzP4MT6MrS3Z6npG2toCPCuvWhZe7Y+d2ZlEF60zU
+--- pHUWg2D1Nfq1SRWsu6njpRAWdFkWjkWRMlcPXKSQf7k
+�+��ӥ�
���<�l#�"���K?f.��L�����ePW�
\ No newline at end of file
diff --git a/secrets/relesoft.age b/secrets/relesoft.age
index 1cd16d5..bd23508 100644
--- a/secrets/relesoft.age
+++ b/secrets/relesoft.age
@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 SIk9MQ hWfgfvibzmIpL5CVharIXW2qX6NN4ti/IWaxNBfCOlA
-BJ2KsVFx/1Ra/gUfFSGqDH2xGtj3ZUCR2JtO9upObCM
--> ssh-ed25519 nivnYg +xvAmrXobATO5hswYotmBrJh40RpCi8UIQ8JBl1YVG4
-Q11BE4UCgmv/c9VQeUuKa97J/JmWB4v+YoxHIa9/EQE
--> ssh-ed25519 egf4NA IgVPAbf5pz/WvI7uI56VKAhtQbCm0A6R8e1QC1nXE0c
-EGb0U+QxTREl4HhWxMLMZcqFsRKEXMqZRRSKdEhdYUU
---- +Sgmew6pn5ttSrqMwGIeWYZ1chQGUzDTRGvHJmBkDNA
-?q8U��gь����e�Cs�ЗT�����E��p'�Z�K�o�
\ No newline at end of file
+-> ssh-ed25519 egf4NA 7MUzjJ4kufXpXDb6J+rNnAAkA3zB68RBTuTcziLlpDY
+r5t1fgh2YJqH0dW+4ucRBs9HQmEKOJA7Hoypd+v9ME8
+-> ssh-ed25519 nivnYg efWLsKs8Ua4L0qv8CXeEAhE2y7+otbHP8xUmHLgb1m4
+YgnuLXmiO5UDwqJt7PgAf599eiU/i9Xl8bItiK6ayak
+-> ssh-ed25519 SIk9MQ F09pgphY8QFcTnu39cOoZnMQ8rXwPyXPsRJRnqsw0Eg
+oNgZppm1kYbnS+gm0M5phtw0D5wqpYVmDXzknnq7yoQ
+--- 2R4aZxVk6f0kYO/AKo064eRSYrZ4ruE7iQLZFmP2uZk
+vr\4I�2�ayҟ6rB�ڷ+8�$���i}����9����%�����
\ No newline at end of file
diff --git a/secrets/relesoft_cargo_token.age b/secrets/relesoft_cargo_token.age
index b57354a..e5dd7cc 100644
--- a/secrets/relesoft_cargo_token.age
+++ b/secrets/relesoft_cargo_token.age
@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 SIk9MQ 6JF0u8WRDM26eTMxB8RHy7gHGD5DyVQO04BUjI8FKFI
-rUSvDpdnbIjeDssPhJ4y3jiuwXfkda42gpRlb5MwZVE
--> ssh-ed25519 egf4NA 2M5u3dE0K0IODav88dkVu3TAfsv1upra3+TtY6eFYFM
-gFcQyRADiG0ruf7OLBrUxOiXMkptpsm7Zo770xdtAnA
--> ssh-ed25519 nivnYg OucwYuH7Z6Ih+lUGEPSs1oh/ZsuqrDHttNVyzR5iXnM
-zavvC+0FtsSAVMcpang0rY7MvWqEG92RZOdozOljb1s
---- LFI08syDoP7BhDymUtGSj26rlvlAIywYrDKs3Ff30N0
-�eR��B�c��T|�m�߹x*�!�������VVn%ï0t(��[�>Ŵ�Ky�����n�.�:�Ԋ�_45�fh:�
�l�
\ No newline at end of file
+-> ssh-ed25519 egf4NA rAXxqI+3a0hpLWfAsSpVZbzyu//s9r9TQFcZrdlrKWY
+0qQL3N3wZgC+rQEM9k4AgOfOu63G4IPKRRA5yaqVOcw
+-> ssh-ed25519 nivnYg zdz++IMXx3M4sAJcgRbzmBGh1ZdFH4z8fjvNJK2e5WI
+DhA+8QTGRl48069S7HIjrL/N+mYtg/DMd5dQqyJfNeQ
+-> ssh-ed25519 SIk9MQ cvmptByV2r8XJOkXTGiZGPZ+FIYgBpPMh76kuOD4FH0
+PQzo5QC2XDNSDtnRAfEyjr2iK+IF4RSehm/Ry6cVSTE
+--- WLRYAYSl+VNOWWnnpkkfJaKMpag4YxlM/WqSHcbJY4c
+Qk�KE��ȨF�ѝ�"vagu�
�)�Ax�۫���"F��yK��K�~�\��M�έ��2w"R��f"�h(����y��h
\ No newline at end of file
diff --git a/secrets/s3fs.age b/secrets/s3fs.age
index 49e782e..2220be8 100644
--- a/secrets/s3fs.age
+++ b/secrets/s3fs.age
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index a063ee4..6b0220b 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -21,4 +21,7 @@ in
   "s3fs.age".publicKeys = systems;
   "shiori_password.age".publicKeys = systems;
   "unsplash_access_key.age".publicKeys = systems;
+  "wg_relesoft_pihlaja.age".publicKeys = systems;
+  "wg_relesoft_saarni.age".publicKeys = systems;
+  "wg_relesoft_kataja.age".publicKeys = systems;
 }
diff --git a/secrets/shiori_password.age b/secrets/shiori_password.age
index ab0f3c2..893dac5 100644
--- a/secrets/shiori_password.age
+++ b/secrets/shiori_password.age
@@ -1,10 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 SIk9MQ NH850utZIMxFFNAZCZHsyjL5f+t3TnhThtVnExWpEHk
-uYEf+jtdqZcr39Yj2vmBZap6lUVdHKSV3O0MYwFk2Xc
--> ssh-ed25519 egf4NA bUcc1F73WG3Jc5BxjG8L4w88uJsY+SbrXO5Yb1ZMzEw
-uAiwubSlvXV+hH2qgQEEUNB69uEVISRgQzluIoV80Jc
--> ssh-ed25519 nivnYg 4Bzp4S/J17xt3pG8L70Kw5rtBjL+Q9r9mnjSMw6FV30
-TALKdu7Xn+p/p6aUifBCoEzian4IEWwYbx7F7X2CLBE
---- yD8ik0HkBt4IcbZxuH5R7Jqk2mqyCOfzqQ+WkI5Orv4
-��Q�@���w��g7#����B)
-U�'�B_λ�Qy�
+-> ssh-ed25519 egf4NA pUVMExd+O89N37IrlsXqzdVXzGMgGKmC608NNhASoU8
+dmWlMRC410lZHDnbvl79ms8RsiaFm5dm6v0MlDMGhlQ
+-> ssh-ed25519 nivnYg 5gsEHFcxaJPfjvvgkJblqlXpIJTGcPyl0tPvqUDOVxs
+MhBdxlcEECecPaAJfS61qpHOFfpNHt6o5K/E3FDPtUI
+-> ssh-ed25519 SIk9MQ 24+BJxfSYK2G96Y8g1WdWRFSaDL/SYTdK6q02Vvof0M
+pQED0L7m3lMOsJ9VAzd73W/wAIyzBq0x5XSc18Onb3I
+--- hOGQS2xgLIDc6C+aGcIDkV03ml2CjkpzPkhKfqbim50
+�H�ri������,��y�F	6U�����NL�5aq0��cF�UH
\ No newline at end of file
diff --git a/secrets/unsplash_access_key.age b/secrets/unsplash_access_key.age
index 72dd04c..0378317 100644
--- a/secrets/unsplash_access_key.age
+++ b/secrets/unsplash_access_key.age
diff --git a/secrets/wg_relesoft_kataja.age b/secrets/wg_relesoft_kataja.age
new file mode 100644
index 0000000..b14f1cc
--- /dev/null
+++ b/secrets/wg_relesoft_kataja.age
diff --git a/secrets/wg_relesoft_pihlaja.age b/secrets/wg_relesoft_pihlaja.age
new file mode 100644
index 0000000..893f9d3
--- /dev/null
+++ b/secrets/wg_relesoft_pihlaja.age
diff --git a/secrets/wg_relesoft_saarni.age b/secrets/wg_relesoft_saarni.age
new file mode 100644
index 0000000..0034943
--- /dev/null
+++ b/secrets/wg_relesoft_saarni.age