thaylen-city: Add to wireguard network

modules/darwin/base/default.nix

@@ -7,6 +7,7 @@ in
   imports = [
     ./emacs
     ./nix
+    ./wireguard
   ];
 
   users.users.${username}.home = "/Users/${username}";

modules/darwin/base/wireguard/default.nix

@@ -0,0 +1,25 @@
+{ config, ... }:
+
+let
+  data = config.chvp.base.network.wireguard.data;
+  subnet = config.chvp.base.network.wireguard.subnet;
+  pskFile = config.chvp.base.network.wireguard.pskFile;
+in
+{
+  networking.wg-quick.interfaces."wg0" = {
+    address = [ "${data.${config.networking.hostName}.ip}/32" ];
+    autostart = true;
+    dns = [ data.lasting-integrity.ip ];
+    mtu = 1342;
+    peers = [
+      {
+        allowedIPs = [ subnet ];
+        endpoint = "lasting-integrity.vanpetegem.me:51820";
+        presharedKeyFile = pskFile;
+        persistentKeepalive = 25;
+        publicKey = data.lasting-integrity.pubkey;
+      }
+    ];
+    privateKeyFile = data.${config.networking.hostName}.privkeyFile;
+  };
+}

modules/nixos/base/network/wireguard.nix

@@ -1,42 +1,11 @@
 { config, lib, pkgs, ... }:
 
 let
-  data = {
+  data = config.chvp.base.network.wireguard.data;
-    fairphone = {
+  subnet = config.chvp.base.network.wireguard.subnet;
-      pubkey = "mHAq+2AP1EZdlSZIxA8UCret8EStrR3nEIU2x6NVETE=";
+  pskFile = config.chvp.base.network.wireguard.pskFile;
-      ip = "10.240.0.4";
-    };
-    kholinar = {
-      pubkey = "oRA22ymFeNQBeRx6Jyd6Gd8EOUpAv9QSFkGs+Br7yEk=";
-      privkeyFile = config.age.secrets."files/wireguard/kholinar.privkey".path;
-      ip = "10.240.0.3";
-    };
-    lasting-integrity = {
-      pubkey = "mid3XfCY2jaNK0J6C9ltFLAbxL0IApwMw9K1Z+PU8C0=";
-      privkeyFile = config.age.secrets."files/wireguard/lasting-integrity.privkey".path;
-      ip = "10.240.0.1";
-    };
-    urithiru = {
-      pubkey = "f4bnm/qNhMW5iXdQcBMmP8IUN6n+pDS15Ikct7QPr0E=";
-      privkeyFile = config.age.secrets."files/wireguard/urithiru.privkey".path;
-      ip = "10.240.0.2";
-    };
-  };
-  subnet = "10.240.0.0/24";
-  pskFile = config.age.secrets."files/wireguard/psk".path;
 in
 {
-  options.chvp.base.network.wireguard = {
-    server = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    onCorporate = lib.mkOption {
-      default = false;
-      example = true;
-    };
-  };
-  config = {
   networking.firewall = {
     allowedUDPPorts = lib.optional config.chvp.base.network.wireguard.server 51820;
     allowedTCPPorts = lib.optional config.chvp.base.network.wireguard.server 8080;
@@ -99,10 +68,7 @@ in
             ([{
               PublicKey = data.lasting-integrity.pubkey;
               AllowedIPs = subnet;
-                Endpoint =
+              Endpoint = "lasting-integrity.vanpetegem.me:51820";
-                  if config.chvp.base.network.wireguard.onCorporate
-                  then "127.0.0.1:51820"
-                  else "lasting-integrity.vanpetegem.me:51820";
               PresharedKeyFile = pskFile;
               PersistentKeepalive = 25;
             }]);
@@ -129,13 +95,6 @@ in
       };
     };
   };
-    age.secrets."files/wireguard/psk" = {
+  age.secrets."files/wireguard/psk".owner = "systemd-network";
-      file = ../../../../secrets/files/wireguard/psk.age;
+  age.secrets."files/wireguard/${config.networking.hostName}.privkey".owner = "systemd-network";
-      owner = "systemd-network";
-    };
-    age.secrets."files/wireguard/${config.networking.hostName}.privkey" = {
-      file = ../../../../secrets/files/wireguard + "/${config.networking.hostName}.privkey.age";
-      owner = "systemd-network";
-    };
-  };
 }

modules/shared/base/default.nix

@@ -6,6 +6,7 @@
     ./nix
     ./phone-push
     ./tmux
+    ./wireguard
     ./zfs
     ./zsh
   ];

modules/shared/base/wireguard/default.nix

@@ -0,0 +1,56 @@
+{ config, lib, ... }:
+
+let
+  data = {
+    fairphone = {
+      pubkey = "mHAq+2AP1EZdlSZIxA8UCret8EStrR3nEIU2x6NVETE=";
+      ip = "10.240.0.4";
+    };
+    kholinar = {
+      pubkey = "oRA22ymFeNQBeRx6Jyd6Gd8EOUpAv9QSFkGs+Br7yEk=";
+      privkeyFile = config.age.secrets."files/wireguard/kholinar.privkey".path;
+      ip = "10.240.0.3";
+    };
+    lasting-integrity = {
+      pubkey = "mid3XfCY2jaNK0J6C9ltFLAbxL0IApwMw9K1Z+PU8C0=";
+      privkeyFile = config.age.secrets."files/wireguard/lasting-integrity.privkey".path;
+      ip = "10.240.0.1";
+    };
+    thaylen-city = {
+      pubkey = "O0q2/W7dRM4LvAL9MSDZqAbGSzqi8AHLVl1sJsRDsUY=";
+      privkeyFile = config.age.secrets."files/wireguard/thaylen-city.privkey".path;
+      ip = "10.240.0.5";
+    };
+    urithiru = {
+      pubkey = "f4bnm/qNhMW5iXdQcBMmP8IUN6n+pDS15Ikct7QPr0E=";
+      privkeyFile = config.age.secrets."files/wireguard/urithiru.privkey".path;
+      ip = "10.240.0.2";
+    };
+  };
+  subnet = "10.240.0.0/24";
+  pskFile = config.age.secrets."files/wireguard/psk".path;
+in
+{
+  options.chvp.base.network.wireguard = {
+    server = lib.mkOption {
+      default = false;
+      example = true;
+    };
+    data = lib.mkOption {
+      default = data;
+      readOnly = true;
+    };
+    subnet = lib.mkOption {
+      default = subnet;
+      readOnly = true;
+    };
+    pskFile = lib.mkOption {
+      default = pskFile;
+      readOnly = true;
+    };
+  };
+  config = {
+    age.secrets."files/wireguard/psk".file = ../../../../secrets/files/wireguard/psk.age;
+    age.secrets."files/wireguard/${config.networking.hostName}.privkey".file = ../../../../secrets/files/wireguard + "/${config.networking.hostName}.privkey.age";
+  };
+}

secrets.nix

@@ -98,6 +98,7 @@ in
 
   "secrets/files/wireguard/kholinar.privkey.age".publicKeys = [ kholinar ] ++ users;
   "secrets/files/wireguard/lasting-integrity.privkey.age".publicKeys = [ lasting-integrity ] ++ users;
+  "secrets/files/wireguard/thaylen-city.privkey.age".publicKeys = [ thaylen-city ] ++ users;
   "secrets/files/wireguard/urithiru.privkey.age".publicKeys = [ urithiru ] ++ users;
   "secrets/files/wireguard/psk.age".publicKeys = hosts ++ users;
 

secrets/files/wireguard/thaylen-city.privkey.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 KOkamg Ave15/4+uu5FWfIK1qLwImESyCDLzilWQeuNiim7MHc
+yU/8z7o6CAQdeoXwOPL6tdJ17kV9Q/jWRZldPk4m9so
+-> ssh-ed25519 s9rb8g r/CcbdZE6VCXnb2VbVFJCbcn/ANYIja0ulmr81tydhQ
+KiKlxc6G1ry4/ryYZ6hoKNJPvLGaN+Q4L2oPqp+3Zbs
+-> ssh-ed25519 +xxExQ TlRgGa91hF8kxkdVKyMQSe0A+8LRYRA270vVUnz4ySs
+9uRwCJxDtnOssBji90+WHg6S+0vohS889YxX47J6sPI
+--- Wgz5JZUMJpoXP/lEXZKIfGVyMdvgMcNeVpzOZ/FmDT0
+GÐ1NÜ;^ÛŠÔŒ–,áwÏéNMÔ.)¾ûÞTu}·J`»¡_½W¢ÍóèåѬ—
+'.que<>²`¿r‹†E<E280A0> ©ó+<2B>×V’Ä•