common wireguard module

1 files changed, 8 insertions, 59 deletions

diff --git a/hosts/nyaan/network.nix b/hosts/nyaan/network.nix
index e5d39aa..ea4f9a5 100644
--- a/hosts/nyaan/network.nix
+++ b/hosts/nyaan/network.nix
@@ -1,32 +1,22 @@
-{ config, ... }:
+{ config, flakeRoot, ... }:
 let
   secrets = config.sops.secrets;
-  # NOTE: port is the same on every host
-  wgPort = 51820;
 in
 {
+  imports = [ (flakeRoot + /wireguard.nix) ];
+
   sops = {
     age.keyFile = "/var/lib/sops-nix/key.txt";
-    secrets = {
-      "wg-priv-key" = {
-        sopsFile = ../../secrets/wg-nyaan-private.txt;
-        owner = "systemd-network";
-        group = "systemd-network";
-        mode = "0640";
-        format = "binary";
-      };
-      "wireless.env" = {
-        sopsFile = ../../secrets/wireless.env;
-        owner = "wpa_supplicant";
-        group = "wpa_supplicant";
-        format = "dotenv";
-      };
+    secrets."wireless.env" = {
+      sopsFile = ../../secrets/wireless.env;
+      owner = "wpa_supplicant";
+      group = "wpa_supplicant";
+      format = "dotenv";
     };
   };
 
   networking = {
     hostName = "nyaan";
-    firewall.allowedUDPPorts = [ wgPort ];
     useNetworkd = true;
     wireless = {
       enable = true;
@@ -71,45 +61,4 @@ in
       2301:db8:acad:a::1 sagittarius sagittarius.local
     '';
   };
-
-  systemd.network = {
-    enable = true;
-    networks."50-wg" = {
-      matchConfig.Name = "wg0";
-      address = [
-        "2301:db8:acad:a::2/128"
-        "192.168.23.2/32"
-      ];
-    };
-    netdevs."50-wg" = {
-      netdevConfig = {
-        Kind = "wireguard";
-        Name = "wg0";
-      };
-
-      wireguardConfig = {
-        ListenPort = wgPort;
-        PrivateKeyFile = config.sops.secrets."wg-priv-key".path;
-        # To automatically create routes for everything in AllowedIPs,
-        # add RouteTable=main
-        RouteTable = "main";
-        # FirewallMark marks all packets send and received by wg0 with the
-        # number 42, which can be used to define policy rules on these packets.
-        FirewallMark = 42;
-      };
-
-      wireguardPeers = [
-        {
-          # sagittarius
-          PublicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI=";
-          AllowedIPs = [
-            "2301:db8:acad:a::1/128"
-            "192.168.23.1/32"
-          ];
-          Endpoint = "95.216.136.85:${toString wgPort}";
-          PersistentKeepalive = 1;
-        }
-      ];
-    };
-  };
 }