3 files changed, 56 insertions, 0 deletions
diff --git a/hosts/sagittarius/sops.nix b/hosts/sagittarius/sops.nix
index 7ba7536..22f8eb2 100644
--- a/hosts/sagittarius/sops.nix
+++ b/hosts/sagittarius/sops.nix
@@ -18,6 +18,13 @@
         owner = "nginx";
         format = "binary";
       };
+      "wg-priv-key" = {
+        sopsFile = ../../secrets/wg-sagittarius-private.txt;
+        owner = "systemd-networkd";
+        group = "systemd-networkd";
+        mode = "0640";
+        format = "binary";
+      };
     };
   };
 }
diff --git a/hosts/sagittarius/web/default.nix b/hosts/sagittarius/web/default.nix
index 2ccf36b..c789e20 100644
--- a/hosts/sagittarius/web/default.nix
+++ b/hosts/sagittarius/web/default.nix
@@ -6,5 +6,6 @@
     ./git.nix
     ./static.nix
     ./navidrome.nix
+    ./wireguard.nix
   ];
 }
diff --git a/hosts/sagittarius/web/wireguard.nix b/hosts/sagittarius/web/wireguard.nix
new file mode 100644
index 0000000..7760174
--- /dev/null
+++ b/hosts/sagittarius/web/wireguard.nix
@@ -0,0 +1,48 @@
+{ config, ... }:
+let
+  # NOTE: port is the same on every host
+  port = 51820;
+in
+{
+  networking.firewall.allowedUDPPorts = [ port ];
+  networking.useNetworkd = true;
+
+  systemd.network = {
+    enable = true;
+    networks."50-wg" = {
+      matchConfig.Name = "wg0";
+      address = [
+        "2301:db8:acad:a::1/128"
+        "192.168.5.1/32"
+      ];
+    };
+    netdevs."50-wg" = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "wg0";
+      };
+
+      wireguardConfig = {
+        ListenPort = port;
+        PrivateKeyFile = config.sops.secrets."wg-priv-key".path;
+        # To automatically create routes for everything in AllowedIPs,
+        # add RouteTable=main
+        RouteTable = "main";
+        # FirewallMark marks all packets send and received by wg0 with the
+        # number 42, which can be used to define policy rules on these packets.
+        FirewallMark = 42;
+      };
+
+      wireguardPeers = [
+        {
+          # nyaan
+          PublicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0=";
+          AllowedIPs = [
+            "2301:db8:acad:a::2/128"
+            "192.168.5.2/32"
+          ];
+        }
+      ];
+    };
+  };
+}