wip

31 files changed, 407 insertions, 6 deletions

diff --git a/ansible/inventory b/ansible/inventory
index d099e8a..f94f73a 100644
--- a/ansible/inventory
+++ b/ansible/inventory
@@ -41,9 +41,15 @@ all:
     biwia:
       ansible_host: biwia.vpn.trygvis.io
     lhn2pi:
+      ansible_host: lhn2pi.vpn.trygvis.io
     lhn2ix:
     kv24ix:
 
+    node1:
+      ansible_host: 9859f51e-1e3e-4c05-a826-b7fbe18d91be.pub.instances.scw.cloud
+    node2:
+      ansible_host: 927624a8-7824-444d-903d-8507eb1e0669.pub.instances.scw.cloud
+
     zh2569.rsync.net:
       ansible_user: zh2569
 
@@ -166,15 +172,21 @@ all:
     tnet:
       hosts:
         akili:
+        astyanax:
         hash:
         knot:
         kv24ix:
         lhn2ix:
+        lhn2pi:
+        node1:
+        node2:
 
     tnet_bgp:
       hosts:
         akili:
         hash:
         knot:
+        node1:
+        node2:
 
 # vim: set filetype=yaml:
diff --git a/tnet/bird-gen.yml b/tnet/bird-gen.yml
new file mode 100644
index 0000000..4a3e19d
--- /dev/null
+++ b/tnet/bird-gen.yml
@@ -0,0 +1,11 @@
+- name: Generate Bird configuration
+  hosts: tnet
+  connection: local
+  gather_facts: False
+  tasks:
+    - file:
+        path: files/{{ inventory_hostname }}
+        state: directory
+    - template:
+        src: bird.conf.j2
+        dest: files/{{ inventory_hostname }}/bird.conf
diff --git a/tnet/files/hash/bird.conf b/tnet/files/hash/bird.conf
new file mode 100644
index 0000000..8cf210a
--- /dev/null
+++ b/tnet/files/hash/bird.conf
@@ -0,0 +1,49 @@
+template bgp tnet_tpl {
+  local    as 4242423538;
+  neighbor internal;
+
+  direct;
+  rr client;
+
+  password "trygvis";
+
+  ipv6 {
+    next hop self;
+    import filter {
+      if is_tnet() then {
+        print proto, ": import accept, net=", net, ", from=", from, ", gw=", gw;
+        accept;
+      }
+      print proto, ": import reject, reason=not tnet"; reject;
+    };
+    # newer bird's only
+    # import keep filtered;
+    export filter {
+      if is_tnet() then {
+        print proto, ": export accept, net=", net, ", from=", from, ", gw=", gw;
+        accept;
+      }
+      print proto, ": export reject, reason=not tnet"; reject;
+    };
+  };
+}
+
+protocol bgp tnet_astyanax from tnet_tpl {
+  neighbor fe80:a0fd:89e4:42c6:f617:7398:abf4:b517;
+  interface "tnet-astyanax";
+}
+
+protocol bgp tnet_knot from tnet_tpl {
+  neighbor fe80:3b20:4cb0:5315:22a:c7de:a45b:8a7c;
+  interface "tnet-knot";
+}
+
+protocol bgp tnet_node1 from tnet_tpl {
+  neighbor fe80:a026:6ec2:b356:21c5:b51:22b9:a1df;
+  interface "tnet-node1";
+}
+
+protocol bgp tnet_node2 from tnet_tpl {
+  neighbor fe80:a7a6:c1a8:c261:232e:7d67:fc27:7c8d;
+  interface "tnet-node2";
+}
diff --git a/tnet/files/knot/bird.conf b/tnet/files/knot/bird.conf
new file mode 100644
index 0000000..cb70e94
--- /dev/null
+++ b/tnet/files/knot/bird.conf
@@ -0,0 +1,39 @@
+template bgp tnet_tpl {
+  local    as 4242423538;
+  neighbor internal;
+
+  direct;
+  rr client;
+
+  password "trygvis";
+
+  ipv6 {
+    next hop self;
+    import filter {
+      if is_tnet() then {
+        print proto, ": import accept, net=", net, ", from=", from, ", gw=", gw;
+        accept;
+      }
+      print proto, ": import reject, reason=not tnet"; reject;
+    };
+    # newer bird's only
+    # import keep filtered;
+    export filter {
+      if is_tnet() then {
+        print proto, ": export accept, net=", net, ", from=", from, ", gw=", gw;
+        accept;
+      }
+      print proto, ": export reject, reason=not tnet"; reject;
+    };
+  };
+}
+
+protocol bgp tnet_hash from tnet_tpl {
+  neighbor fe80:3b20:4cb0:5315:22a:c7de:a45b:8a7d;
+  interface "tnet-hash";
+}
+
+protocol bgp tnet_node1 from tnet_tpl {
+  neighbor fe80:58eb:3930:1815:2a6d:8918:70c9:96f3;
+  interface "tnet-node1";
+}
diff --git a/tnet/files/node1/bird.conf b/tnet/files/node1/bird.conf
new file mode 100644
index 0000000..1ac0335
--- /dev/null
+++ b/tnet/files/node1/bird.conf
@@ -0,0 +1,39 @@
+template bgp tnet_tpl {
+  local    as 4242423538;
+  neighbor internal;
+
+  direct;
+  rr client;
+
+  password "trygvis";
+
+  ipv6 {
+    next hop self;
+    import filter {
+      if is_tnet() then {
+        print proto, ": import accept, net=", net, ", from=", from, ", gw=", gw;
+        accept;
+      }
+      print proto, ": import reject, reason=not tnet"; reject;
+    };
+    # newer bird's only
+    # import keep filtered;
+    export filter {
+      if is_tnet() then {
+        print proto, ": export accept, net=", net, ", from=", from, ", gw=", gw;
+        accept;
+      }
+      print proto, ": export reject, reason=not tnet"; reject;
+    };
+  };
+}
+
+protocol bgp tnet_hash from tnet_tpl {
+  neighbor fe80:a026:6ec2:b356:21c5:b51:22b9:a1de;
+  interface "tnet-hash";
+}
+
+protocol bgp tnet_knot from tnet_tpl {
+  neighbor fe80:58eb:3930:1815:2a6d:8918:70c9:96f2;
+  interface "tnet-knot";
+}
diff --git a/tnet/files/node2/bird.conf b/tnet/files/node2/bird.conf
new file mode 100644
index 0000000..e1f1898
--- /dev/null
+++ b/tnet/files/node2/bird.conf
@@ -0,0 +1,39 @@
+template bgp tnet_tpl {
+  local    as 4242423538;
+  neighbor internal;
+
+  direct;
+  rr client;
+
+  password "trygvis";
+
+  ipv6 {
+    next hop self;
+    import filter {
+      if is_tnet() then {
+        print proto, ": import accept, net=", net, ", from=", from, ", gw=", gw;
+        accept;
+      }
+      print proto, ": import reject, reason=not tnet"; reject;
+    };
+    # newer bird's only
+    # import keep filtered;
+    export filter {
+      if is_tnet() then {
+        print proto, ": export accept, net=", net, ", from=", from, ", gw=", gw;
+        accept;
+      }
+      print proto, ": export reject, reason=not tnet"; reject;
+    };
+  };
+}
+
+protocol bgp tnet_hash from tnet_tpl {
+  neighbor fe80:a7a6:c1a8:c261:232e:7d67:fc27:7c8c;
+  interface "tnet-hash";
+}
+
+protocol bgp tnet_knot from tnet_tpl {
+  neighbor fe80:9dd8:abac:cf05:aea3:dc03:4c74:32da;
+  interface "tnet-knot";
+}
diff --git a/tnet/host_vars/akili/bird.yml b/tnet/host_vars/akili/bird.yml
new file mode 100644
index 0000000..b59526c
--- /dev/null
+++ b/tnet/host_vars/akili/bird.yml
@@ -0,0 +1,3 @@
+tnet_bird_peers:
+  hash:
+  knot:
diff --git a/tnet/host_vars/astyanax/bird.yml b/tnet/host_vars/astyanax/bird.yml
new file mode 100644
index 0000000..b59526c
--- /dev/null
+++ b/tnet/host_vars/astyanax/bird.yml
@@ -0,0 +1,3 @@
+tnet_bird_peers:
+  hash:
+  knot:
diff --git a/tnet/host_vars/astyanax/wg.yml b/tnet/host_vars/astyanax/wg.yml
index dd446a0..e12db34 100644
--- a/tnet/host_vars/astyanax/wg.yml
+++ b/tnet/host_vars/astyanax/wg.yml
@@ -1,7 +1,7 @@
 tnet_wg:
   knot:
     endpoint: knot.inamo.no:51006
-    address: fdb1:4242:3538:ffff:c32d:ad30:541d:ab31
+    address: fe80:6728:53fc:fc81:40b3:9beb:8336:ba57
   hash:
     endpoint: hash.trygvis.io:51004
-    address: fdb1:4242:3538:ffff:b383:bc11:c452:eaf5
+    address: fe80:a0fd:89e4:42c6:f617:7398:abf4:b517
diff --git a/tnet/host_vars/hash/bird.yml b/tnet/host_vars/hash/bird.yml
new file mode 100644
index 0000000..9176312
--- /dev/null
+++ b/tnet/host_vars/hash/bird.yml
@@ -0,0 +1,5 @@
+tnet_bird_peers:
+  knot:
+  node1:
+  node2:
+  astyanax:
diff --git a/tnet/host_vars/hash/wg.yml b/tnet/host_vars/hash/wg.yml
index bdd1800..c7d9363 100644
--- a/tnet/host_vars/hash/wg.yml
+++ b/tnet/host_vars/hash/wg.yml
@@ -12,4 +12,10 @@ tnet_wg:
     address: fe80:6195:1d43:9655:35f7:9dba:798c:26b8
   astyanax:
     port: 51004
-    address: fdb1:4242:3538:ffff:b383:bc11:c452:eaf4
+    address: fe80:a0fd:89e4:42c6:f617:7398:abf4:b516
+  node1:
+    port: 51005
+    address: fe80:a026:6ec2:b356:21c5:b51:22b9:a1de
+  node2:
+    port: 51006
+    address: fe80:a7a6:c1a8:c261:232e:7d67:fc27:7c8c
diff --git a/tnet/host_vars/knot/bird.yml b/tnet/host_vars/knot/bird.yml
new file mode 100644
index 0000000..e8b20e7
--- /dev/null
+++ b/tnet/host_vars/knot/bird.yml
@@ -0,0 +1,3 @@
+tnet_bird_peers:
+  hash:
+  node1:
diff --git a/tnet/host_vars/knot/wg.yml b/tnet/host_vars/knot/wg.yml
index 48053fc..6fe932e 100644
--- a/tnet/host_vars/knot/wg.yml
+++ b/tnet/host_vars/knot/wg.yml
@@ -19,4 +19,10 @@ tnet_wg:
     address: fdb1:4242:3538:ffff:374e:2c7d:319e:e526
   astyanax:
     port: 51006
-    address: fdb1:4242:3538:ffff:c32d:ad30:541d:ab30
+    address: fe80:6728:53fc:fc81:40b3:9beb:8336:ba56
+  node1:
+    port: 51007
+    address: fe80:58eb:3930:1815:2a6d:8918:70c9:96f2
+  node2:
+    port: 51008
+    address: fe80:9dd8:abac:cf05:aea3:dc03:4c74:32da
diff --git a/tnet/host_vars/kv24ix/bird.yml b/tnet/host_vars/kv24ix/bird.yml
new file mode 100644
index 0000000..b59526c
--- /dev/null
+++ b/tnet/host_vars/kv24ix/bird.yml
@@ -0,0 +1,3 @@
+tnet_bird_peers:
+  hash:
+  knot:
diff --git a/tnet/host_vars/lhn2ix/bird.yml b/tnet/host_vars/lhn2ix/bird.yml
new file mode 100644
index 0000000..b59526c
--- /dev/null
+++ b/tnet/host_vars/lhn2ix/bird.yml
@@ -0,0 +1,3 @@
+tnet_bird_peers:
+  hash:
+  knot:
diff --git a/tnet/host_vars/lhn2pi/bird.yml b/tnet/host_vars/lhn2pi/bird.yml
new file mode 100644
index 0000000..b59526c
--- /dev/null
+++ b/tnet/host_vars/lhn2pi/bird.yml
@@ -0,0 +1,3 @@
+tnet_bird_peers:
+  hash:
+  knot:
diff --git a/tnet/host_vars/node1/bird.yml b/tnet/host_vars/node1/bird.yml
new file mode 100644
index 0000000..b59526c
--- /dev/null
+++ b/tnet/host_vars/node1/bird.yml
@@ -0,0 +1,3 @@
+tnet_bird_peers:
+  hash:
+  knot:
diff --git a/tnet/host_vars/node1/wg.yml b/tnet/host_vars/node1/wg.yml
index 6ce5e8b..dfacbf2 100644
--- a/tnet/host_vars/node1/wg.yml
+++ b/tnet/host_vars/node1/wg.yml
@@ -1,3 +1,7 @@
 tnet_wg:
   knot:
+    endpoint: knot.inamo.no:51007
+    address: fe80:58eb:3930:1815:2a6d:8918:70c9:96f3
   hash:
+    endpoint: hash.trygvis.io:51005
+    address: fe80:a026:6ec2:b356:21c5:b51:22b9:a1df
diff --git a/tnet/host_vars/node2/bird.yml b/tnet/host_vars/node2/bird.yml
new file mode 100644
index 0000000..b59526c
--- /dev/null
+++ b/tnet/host_vars/node2/bird.yml
@@ -0,0 +1,3 @@
+tnet_bird_peers:
+  hash:
+  knot:
diff --git a/tnet/host_vars/node2/wg.yml b/tnet/host_vars/node2/wg.yml
index 6ce5e8b..891c15a 100644
--- a/tnet/host_vars/node2/wg.yml
+++ b/tnet/host_vars/node2/wg.yml
@@ -1,3 +1,7 @@
 tnet_wg:
   knot:
+    endpoint: knot.inamo.no:51008
+    address: fe80:9dd8:abac:cf05:aea3:dc03:4c74:32db
   hash:
+    endpoint: hash.trygvis.io:51006
+    address: fe80:a7a6:c1a8:c261:232e:7d67:fc27:7c8d
diff --git a/tnet/keys/wg-hash-node1.pub b/tnet/keys/wg-hash-node1.pub
new file mode 100644
index 0000000..8e33ba3
--- /dev/null
+++ b/tnet/keys/wg-hash-node1.pub
@@ -0,0 +1 @@
+1cNynnx5gPRzgr6JNCPqzlfQP1SuRc4XN3wlWxbIVF4=
\ No newline at end of file
diff --git a/tnet/keys/wg-hash-node1.sops.key b/tnet/keys/wg-hash-node1.sops.key
new file mode 100644
index 0000000..7982e74
--- /dev/null
+++ b/tnet/keys/wg-hash-node1.sops.key
@@ -0,0 +1,28 @@
+{
+	"data": "ENC[AES256_GCM,data:J4ZEwFTTSOcMCUNbBxeufrHRg75BmlTVv0gPs7xVdB9RtnQ+G859ZdDARSk=,iv:dEqxGTSmnWjZzc8kirfyTkJfewUVcPejbzG9RDQnG4Y=,tag:SdiX98tkWOW7oAcxLMJv9g==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMUkYyZjZ2NUd2dXd1QWZk\nYms0UDJKajYyb3VnOHdCVDVZVWdVTGF0VDNzCkE4V2dIN2V4MWUycXBLem94aFNu\nTERTZ0xHN1FwK0w0SVNkMGJOcUx6aGMKLS0tIG9OdG1xL1pLM1NtS2pQV0J2bGFR\nZ1dJWDhjcnNkREh3aXlHa29teUU4UWcKj62Piukjg3hk2MWvXRhkmAznsQgclqST\no6gored5zOcjZg+RFZd5RgLvNQxxwR/5dfZPyBXfjPIQi2+g7UJDfQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5ems3RGdWZ0V5NVVMdHpa\nZDM4Nm05QTJjMWx6QXZqbUIxZFlIOUF0WDJZCkV0OWxIOXJUcnc0R3BMNEFSTks2\nbjRCb0lIRWJqRkcwc25nVDArNWRtSmMKLS0tIHZEbzl5N2NaNGduQ1ROK2Mvand4\naTQrbFA0L05hbGxUNDRQb0lScll3NjAKTjRRiBpoHW9kLZS0YiZ3ZKK+gjBzErNU\n64/LLgZIsKrWnXDxM1szVf0wDfx5j2VvzjE8yDszd0N4iXzobjwt9w==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhbGl4bnZNNHVXQmxtNjZy\nenpyYXBobEwwQUx0Z05DSzNvM2pkb281NkY4ClV5djRJTm91MmQvNE1JY0QrNXNj\nN1YxNldBZFdhRVlLSmROaitKMzkzWDAKLS0tIElNbm5lbGFDMHE1N1owMTFhektq\nY0Y2VU5SeVQ5c09wRm41dVhxZW5VMEUKKCL9H1dKgWaFg6KpDjPy4QXAQDAYfO6W\nxh/eX5I3OvpAHSVvTGL0LVQVBI9Md27f9UZIKIXOEMrrborMtmTqjg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-06-11T08:37:25Z",
+		"mac": "ENC[AES256_GCM,data:d2q6CE/Um1sEZ+Tbg0xYTSvl3/aEUdo0M+8rAh24IlM3p4au9mEHGk4WzT+fyxYnmAAeLFyf+XMcGP4nil7dut0Z22fTOBrgehpkMobbHEIqOhMa3d3I9WyV4h4AQHMyWWjZhTVk7uVCym7qiRD91ucR3vG/ax3aKRb43OYx+ZE=,iv:GauMpvYiClHwjQEYPlI5/vaUst6+eOdo5+8L8b7VZeY=,tag:kNJ2fSH5Z++PehOWQYJMSw==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}
\ No newline at end of file
diff --git a/tnet/keys/wg-hash-node2.pub b/tnet/keys/wg-hash-node2.pub
new file mode 100644
index 0000000..877b702
--- /dev/null
+++ b/tnet/keys/wg-hash-node2.pub
@@ -0,0 +1 @@
+X2rEOlHyKs62HW0nAaIHEZFTprGXhLb2de/hAQcbFng=
\ No newline at end of file
diff --git a/tnet/keys/wg-hash-node2.sops.key b/tnet/keys/wg-hash-node2.sops.key
new file mode 100644
index 0000000..4fc6c33
--- /dev/null
+++ b/tnet/keys/wg-hash-node2.sops.key
@@ -0,0 +1,28 @@
+{
+	"data": "ENC[AES256_GCM,data:4GvFf7qZz4uH4scmvpSN0x5ei8XoDW/raxwIRPH1Y6+9wnj7zmVELIPytCI=,iv:7S16T48B5x8B28WXCpNwVArVIucDeGOilOgw/nUBdN4=,tag:oOHo2KT044rDhvRQnvsB+A==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLQTJ4ZEFKN3IyY0VLVU1R\ndnZadTByc3I2d1h3Q2xZQkZPL1FNcWI0V2dJClVOdnNIaTljNXQzQU4xZXNIMFBi\nR01mZHVtWjZUTjVtZGN3SkJYWTk0NW8KLS0tIFBMdnl2Rk91aGhOd0FWMytFblow\ncWlKN0FhN2ZsRWJtMFNnU2llK21HWHcKPOP3SG4DdnseZjaOPQXBsqtxYo2NBQfK\n9hyqlhD02AzP7XGrf++YS8FJ3nqOrJ/NV5cYeOEDCMTDqQ1DVwLXFg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2Q1hNbVZ3UjJlL2RLUTY2\ndHNWZTVlaHpuM3djWE9UTzlBN1VmSVBBaW1ZCnM4M0hrblI0UmxJYXhjT2lmTWlU\nVkVIdVIzUWN1LzV3Q0hVM3lkcWgwejAKLS0tIEFPSit5UGRCeks4NXhDSE9XNXFE\nc3FTYmUyaW1GdW5YbHFhN2U3Yis2QTgKuJAdQqbxWrm86Lsn+xv5XQNxiE+krq9z\n6PoViqeLVqP54D4TGsQ7HBWD5k+mK1IbHdiSrf6lCw2AIiZOQXACdw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpSUJIVVNlN3Bac3M4cFlS\nVHUwM2FNRnY1bFFxb1Z4RE1aYnVoK3NxT1djCmVnSUJ0cGZ0WStPZXY4Y05LVkxt\nd1hIQ0V6VWYwWi9WVnVpUVExbU5tZzAKLS0tIDgzcmEzUnMvcXNES2kxKzlHRUpt\nRERyelpQaXVVTHI3WitXT3hkbFhmOGsKq4MW9Pdngt2L0/Jyhj9IRIT8t2/a0OXQ\nhpi1zBq8pyyqgsOXTornPYHmRAtPNULetzFbV3l+JWajHeemCA7jLA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-06-11T08:37:26Z",
+		"mac": "ENC[AES256_GCM,data:hMv9t+1GswxvoHlNUEH+EGJesDRTolk2PMWDkk9GggOxbkMxZS+Unl/79Hj+nheclsWkxIAI6CG1Sr4/qiGdB3yX39s7O/LgiXnNV6yYirVJ+Qrs3T3oRM1HCk9Y5odb42bqW+QoCdEhn4pJk1oL1n8ZrjpEzE1cf9ChAhNRRzY=,iv:JzmYGLYfH920z0XZJVH+ZNCr+FlRu+VnC2iPnCiydHg=,tag:YclQ/r9YlgC2xb9Ng4UIQQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}
\ No newline at end of file
diff --git a/tnet/keys/wg-knot-node1.pub b/tnet/keys/wg-knot-node1.pub
new file mode 100644
index 0000000..1507a5f
--- /dev/null
+++ b/tnet/keys/wg-knot-node1.pub
@@ -0,0 +1 @@
+thONllLZCmXl09Fpj0hJXMC71RL5fBUWYL1pSvQFDhE=
\ No newline at end of file
diff --git a/tnet/keys/wg-knot-node1.sops.key b/tnet/keys/wg-knot-node1.sops.key
new file mode 100644
index 0000000..7612836
--- /dev/null
+++ b/tnet/keys/wg-knot-node1.sops.key
@@ -0,0 +1,28 @@
+{
+	"data": "ENC[AES256_GCM,data:kDjtgcIJwZdtUmzeZ+HtEM2FPYF+W9gWCm55vdSxC3scA6MoxNBRSxw4uQg=,iv:4K18STAhTTxtpAnQCHaNYbVlg+M8iyxAX9sYbeetvWw=,tag:PcVWrkISwxvnBXSoFwJ0Bg==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0ZVdCNFdSd05jTHo0c1Fm\nYUpPcXA4ODJ6cUdHUGxNUVc3UVpMVmFjM0Y4CjN4ajB2aE9oVEc5blk2OEJaRW1y\nUjVxUlI2bUVvZGpEOWRpMTRGMnZGRWsKLS0tIDQySDlRU0lIdjExZkkrMTFaNTFs\nRnBrVXN1WUxBbTBjUm9BQ0pTOWRXMEkKmkogKiY+AN+6MTuu1cj8l9Xw/Jzt+sXC\njpnl99+hAp0WmUV5+tqq3jGyzURuYpkoG+qX19jcVxMhwCx0A+JJZg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUcGxKS0VCWk1NOTR5ZVB2\nZUpKaWMrbGVqREZLVG1mZk9WSU43YXhwVjBBCkJRc2QvcmhFNFUyaTFKbVhOc3RM\nY0RZTVY5TEJYQTEyM20wS2NJMDEyYWMKLS0tIGJZRE16a2pEb2Q1ZmFTNTJiWVo1\nb0ZGM0xMeC85bWM4VHU3RWhKczE3Z28Karpa7UyGJmwGcy+dTnie+tYRo99YME0h\n8c/0oWNIQYKuNU0LvmXLaCXfANWNoW++MEYcj8ctTH8stOScqZ20wA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6QnpkdytmUGpwM1ZHSXd5\neEpMM3VZK3p0YTdhN2QwazhMTThYYU50NFZnCjVmWWxsSHpSa2x1OHlSU2liOTUr\nVHJYWWpZbXlwVDc1N3NLODJtaTFjM2cKLS0tIEZ4TExVVDBiT0diL3dlL1JzNzdn\nbG1NS3lDQmJWSlNLamlhejVsU2MvWkUKi/LFKOdgK3SKTwP2LdiWd4egqYI5+xAi\nHOWnFQGnljXuQlRXBHv20fq0QwWm8wPJnzg7QK4wNVAWAjZwQXeMXg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-06-11T08:37:28Z",
+		"mac": "ENC[AES256_GCM,data:5uwz5pswuas/97KI8n4fm/+sjshkNHdRlS3k28xRftcNRsTi/k9Z1omhfLlwKKL3D/955UyHnnV86XvZPQfCxPm/I/5HbpFMyqKP4g88wSxN7poI+CBM+PNCeN/HHb0oIbq7Z72vq3VTI4Prs2V3/i1E5LE+4Sx4IFE2lmP9gjI=,iv:XG4uF8aqGBjKN7yTNWptmQtQjT05eOE/J8zTrOD8dGw=,tag:HpOf1YyQl36SJw0DpgW//w==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}
\ No newline at end of file
diff --git a/tnet/keys/wg-knot-node2.pub b/tnet/keys/wg-knot-node2.pub
new file mode 100644
index 0000000..8c9f071
--- /dev/null
+++ b/tnet/keys/wg-knot-node2.pub
@@ -0,0 +1 @@
+4shyuJgqiQsaRZG0zuD3WWEJP2eEzNSpt2vfcUXqikg=
\ No newline at end of file
diff --git a/tnet/keys/wg-knot-node2.sops.key b/tnet/keys/wg-knot-node2.sops.key
new file mode 100644
index 0000000..3395667
--- /dev/null
+++ b/tnet/keys/wg-knot-node2.sops.key
@@ -0,0 +1,28 @@
+{
+	"data": "ENC[AES256_GCM,data:/yNbyRXzUhx5OJBiSsV0sGY4n85fBLV4wFBsbM2sHOO4FkvBQOKXRfEeNHI=,iv:x0Zcv+f17YYoGGN5lXSHBTta3+8eX8NrnmSeKf2t0gc=,tag:uBjDTRMrhuceisM0V0eH+g==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age13wv3rp0varlg4nvt3tca48fq8u9q3mc6yfdekjeapcmc7kaq4dysrzcmv3",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaT25BVjBxUk5IdlVRNmZS\ndXFRVTJkdFdRMEJMdnQ1eWxMcTMwSGRWMGpVCndNVm1seHJpSnk0R1A5TVB5bFlE\nbjdHK1owNm5Bc25PK2czdHJHMys5NUUKLS0tIDhZdUVybmNkN25XUU9wbVZxSHZ2\nenFxM0t3V2RXKzRWZ25sVzJaUU9Hd0UKIaW5AiVahrrVim0whQTFE4YjEh2Rel5r\nm5rgebK9IdjwG6iUWQlnC+xaZFcqSyp6S+rGLBg/Axg2aAJpCUVcIg==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1mvh832crygenu5tu5njtraraet656rzwnawuasjggvs999dc9ueqj9qclw",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRTzhoMHlVcjBFdFAvRVpi\ndlpuTzFuOGNaaG5EbG0wNWRtY3ZBSEkwQ0RNCnM0V2JyNHZNblJCOXlOWFNYQTFm\nc2VtTmt4c21Ma2Z4VDdubm5YYkpkU3MKLS0tIEtlQStSR05Nb3h5L1FkcFJ2Tjd1\naStFTWlzMVBLVnAxSWRoYjZPdUN0UFkKVgByyiUXtgDi1Z1AivQsNA6lUKwB9iQM\nh7ch10JBPSNVrjXisdxU3qoBeuOKl9ZmTue/aR1clvJqkhDN5BzX8g==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1teasctdpkatekpsa47q58d3ugwyyqcuj5v9udtusk7ca9sfv694sw057a5",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWQ2FSZ0NocWlaemZPT3NW\nU3pwOFdZVlZzTGVsNHlMa2J2SzBleWJIdTM4CnZYTFVtdFErNyt4QnIzVGdsekxy\nZjZmR1lKZDRDbnZCQ3V4TEd1VTE1SVEKLS0tIGRPNGhnMjVKZnpwN2kvbkhNL1Nw\nOFN1azRiTVg3VndBWFREYVAzdFFEK0UKngv/lSquans6wzi3qEAaOXdTttWsayKb\nhicgFbKmwdcI6oW39PfkZLm9G+1/sBSDeEBCO/ysgygR5Qn2oG55dw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-06-11T08:37:28Z",
+		"mac": "ENC[AES256_GCM,data:COfWtS5eOQ5cG9cqQyhwyjntpjbo7vzk5g/Gs7/wGZOInxp6eVSGMSxCr7hxaHNZDpcYgMYiAHOoo4GRCQIm0nalryzPd5oLPLZKzNlRdlnpvxQuk8JOB+WPXf3kz5SbjfMU3fLt1/msdGAafZ/sOB9agRozLOc7LBPX1XyTZ4o=,iv:Zw5/T/mSKbh8VSlfbx7xxx72e7j0AILCXx9UglqY+IE=,tag:ZzKtg5bpbz84dJt4lFprIA==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.7.3"
+	}
+}
\ No newline at end of file
diff --git a/tnet/templates/bird.conf.j2 b/tnet/templates/bird.conf.j2
new file mode 100644
index 0000000..45dc318
--- /dev/null
+++ b/tnet/templates/bird.conf.j2
@@ -0,0 +1,36 @@
+template bgp tnet_tpl {
+  local    as 4242423538;
+  neighbor internal;
+
+  direct;
+  rr client;
+
+  password "trygvis";
+
+  ipv6 {
+    next hop self;
+    import filter {
+      if is_tnet() then {
+        print proto, ": import accept, net=", net, ", from=", from, ", gw=", gw;
+        accept;
+      }
+      print proto, ": import reject, reason=not tnet"; reject;
+    };
+    # newer bird's only
+    # import keep filtered;
+    export filter {
+      if is_tnet() then {
+        print proto, ": export accept, net=", net, ", from=", from, ", gw=", gw;
+        accept;
+      }
+      print proto, ": export reject, reason=not tnet"; reject;
+    };
+  };
+}
+{% for p in tnet_bird_peers|default([])|sort %}
+
+protocol bgp tnet_{{ p }} from tnet_tpl {
+  neighbor {{ hostvars[p].tnet_wg[inventory_hostname].address }};
+  interface "tnet-{{ p }}";
+}
+{% endfor %}
diff --git a/tnet/wg-keys.yml b/tnet/wg-keys.yml
index 1979619..1980b97 100644
--- a/tnet/wg-keys.yml
+++ b/tnet/wg-keys.yml
@@ -1,4 +1,3 @@
----
 - name: Generate Wireguard keys
   hosts: tnet
   connection: local
diff --git a/tnet/wg-links-link.yml b/tnet/wg-links-link.yml
index aaaf01f..6f1bb87 100644
--- a/tnet/wg-links-link.yml
+++ b/tnet/wg-links-link.yml
@@ -1,3 +1,9 @@
+- notify: systemctl restart systemd-networkd
+  become: yes
+  file:
+    path: "/etc/systemd/network/50-tnet-{{ inventory_hostname }}-{{ item.key }}.netdev"
+    state: absent
+
 - name: "Make netdev for {{ inventory_hostname }} -> {{ item.key }}"
   notify: systemctl restart systemd-networkd
   become: yes
@@ -26,6 +32,12 @@
       PersistentKeepalive=60
       {% endif %}
 
+- notify: systemctl restart systemd-networkd
+  become: yes
+  file:
+    path: "/etc/systemd/network/50-tnet-{{ inventory_hostname }}-{{ item.key }}.network"
+    state: absent
+
 - name: "Make network for {{ inventory_hostname }} -> {{ item.key }}"
   notify: systemctl restart systemd-networkd
   become: yes
@@ -38,4 +50,4 @@
       Name=tnet-{{ item.key }}
 
       [Network]
-      Address={{ item.value.address }}/127
+      Address={{ item.value.address }}/64