{ config, pkgs, lib, ... }: { environment.systemPackages = [ pkgs.wireguard-tools pkgs.mosh ]; networking.nat = { enable = true; externalInterface = "ens3"; internalInterfaces = [ "wg0" ]; }; networking.firewall = { allowedUDPPorts = [ 60990 ]; }; networking.wireguard.interfaces.wg0 = { ips = [ "10.0.69.1/24" ]; listenPort = 60990; privateKeyFile = "/var/lib/wireguard/private"; generatePrivateKeyFile = true; # TODO agenix secret peers = [ { # box publicKey = "Ra78mOc110K7URN5uB3m9d78iBKgeRHzT+3HkiFp9BU="; allowedIPs = [ "10.0.69.4/32" ]; } { # line publicKey = "fsb1FuGmYi89p4CVXytKw2FYamONKtoanxrgs/dJjC8="; allowedIPs = [ "10.0.69.3/32" ]; } { # curve publicKey = "kzw+51vVYkitGmSMJPAj1jdhzmxhvmSrrIQ4Ar8wzlI="; allowedIPs = [ "10.0.69.2/32" ]; } { # helix publicKey = "gcdq86hhEUlqF2chqYB/F8pALyAMNFvwLycxBoHuoDs="; allowedIPs = [ "10.0.69.5/32" ]; } ]; }; }