helm/modules/wireguard.nix

{ config, lib, pkgs, ... }:
with lib;
let
  cfg = config.mossnet.wg;
in
{
  options = {
    mossnet.wg = {
      enable = mkEnableOption "Gain access to all mossnet systems through wireguard";
      ips = lib.mkOption {
        type = with types; listOf str;
        default = { };
        example = literalExample ''
          [ "10.0.69.2/24" ];
        '';
        description = ''
          The IP this machine is allowed to connect to
        '';
      };
      privateKeyFile = lib.mkOption {
        type = types.path;
        default = { };
        example = literalExample ''
          /run/agenix/wg-curve
        '';
        description = ''
          The private ssh key file to use to connect!
          Remember set age.secrets.*.file and age.secrets.*.user
        '';
      };
    };
  };
  config = mkIf cfg.enable {
    networking.firewall.allowedUDPPorts = [ 60990 ];
    networking.wireguard.interfaces = {
      wg0 = {
        ips = cfg.ips;
        listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers)

        privateKeyFile = cfg.privateKeyFile;
        peers = [
          # For a client configuration, one peer entry for the server will suffice.
          {
            publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI=";
            allowedIPs = [ "10.0.69.0/24" ];
            # Set this to the server IP and port.
            endpoint = "sealight.xyz:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
            persistentKeepalive = 25;
          }
        ];
      };
    };
  };
}