{ config, lib, pkgs, ... }: with lib; let cfg = config.mossnet.wg; in { options = { mossnet.wg = { enable = mkEnableOption "Gain access to all mossnet systems through wireguard"; ips = lib.mkOption { type = with types; listOf str; default = { }; example = literalExample '' [ "10.0.69.2/24" ]; ''; description = '' The IP this machine is allowed to connect to ''; }; privateKeyFile = lib.mkOption { type = types.path; default = { }; example = literalExample '' /run/agenix/wg-curve ''; description = '' The private ssh key file to use to connect! Remember set age.secrets.*.file and age.secrets.*.user ''; }; }; }; config = mkIf cfg.enable { networking.firewall.allowedUDPPorts = [ 60990 ]; networking.wireguard.interfaces = { wg0 = { ips = cfg.ips; listenPort = 60990; # to match firewall allowedUDPPorts (without this wg uses random port numbers) privateKeyFile = cfg.privateKeyFile; peers = [ # For a client configuration, one peer entry for the server will suffice. { publicKey = "c1J4p63rD3IlszugMZiki7UBV3YmDdqa3DU4UejXzAI="; allowedIPs = [ "10.0.69.0/24" ]; # Set this to the server IP and port. endpoint = "149.28.163.78:60990"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577 persistentKeepalive = 25; } ]; }; }; }; }