common wireguard module

1 files changed, 3 insertions, 42 deletions

diff --git a/hosts/sagittarius/network.nix b/hosts/sagittarius/network.nix
index 9612011..7dac324 100644
--- a/hosts/sagittarius/network.nix
+++ b/hosts/sagittarius/network.nix
@@ -1,15 +1,12 @@
-{ config, ... }:
-let
-  # NOTE: port is the same on every host
-  wgPort = 51820;
-in
+{ flakeRoot, ... }:
 {
+  imports = [ (flakeRoot + /wireguard.nix) ];
+
   networking = {
     hostName = "sagittarius";
     useNetworkd = true;
     firewall = {
       allowedTCPPorts = [ 22 ];
-      allowedUDPPorts = [ wgPort ];
     };
   };
 
@@ -23,42 +20,6 @@ in
         address = [ "2a01:4f9:c012:c7a7::1/64" ];
         routes = [ { Gateway = "fe80::1"; } ];
       };
-      "50-wg" = {
-        matchConfig.Name = "wg0";
-        address = [
-          "2301:db8:acad:a::1/128"
-          "192.168.23.1/32"
-        ];
-      };
-    };
-
-    netdevs."50-wg" = {
-      netdevConfig = {
-        Kind = "wireguard";
-        Name = "wg0";
-      };
-
-      wireguardConfig = {
-        ListenPort = wgPort;
-        PrivateKeyFile = config.sops.secrets."wg-priv-key".path;
-        # To automatically create routes for everything in AllowedIPs,
-        # add RouteTable=main
-        RouteTable = "main";
-        # FirewallMark marks all packets send and received by wg0 with the
-        # number 42, which can be used to define policy rules on these packets.
-        FirewallMark = 42;
-      };
-
-      wireguardPeers = [
-        {
-          # nyaan
-          PublicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0=";
-          AllowedIPs = [
-            "2301:db8:acad:a::2/128"
-            "192.168.23.2/32"
-          ];
-        }
-      ];
     };
   };
 }