From 8959cbf02499a995374816d8640687ad97d3fd73 Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Sun, 24 May 2026 09:20:32 +0200
Subject: sagittarius: move all network config into one file

---
 hosts/sagittarius/default.nix       | 16 +---------
 hosts/sagittarius/network.nix       | 64 +++++++++++++++++++++++++++++++++++++
 hosts/sagittarius/web/default.nix   |  1 -
 hosts/sagittarius/web/wireguard.nix | 48 ----------------------------
 4 files changed, 65 insertions(+), 64 deletions(-)
 create mode 100644 hosts/sagittarius/network.nix
 delete mode 100644 hosts/sagittarius/web/wireguard.nix

(limited to 'hosts/sagittarius')

diff --git a/hosts/sagittarius/default.nix b/hosts/sagittarius/default.nix
index 2b3e3db..b9d7683 100644
--- a/hosts/sagittarius/default.nix
+++ b/hosts/sagittarius/default.nix
@@ -10,27 +10,13 @@
     ./ssh.nix
     ./web
     ./sops.nix
+    ./network.nix
   ];
 
   boot.loader.grub.device = "/dev/sda";
   time.timeZone = "Europe/Helsinki";
 
   environment.systemPackages = [ pkgs.rclone ];
-  networking = {
-    hostName = "sagittarius";
-    useNetworkd = true;
-    firewall.allowedTCPPorts = [ 22 ];
-  };
-  systemd.network = {
-    enable = true;
-    networks."10-wan" = {
-      matchConfig.Name = "enp1s0";
-      networkConfig.DHCP = "ipv4";
-      address = [ "2a01:4f9:c012:c7a7::1/64" ];
-      routes = [ { Gateway = "fe80::1"; } ];
-    };
-  };
-
   virtualisation.podman = {
     enable = true;
     autoPrune.enable = true;
diff --git a/hosts/sagittarius/network.nix b/hosts/sagittarius/network.nix
new file mode 100644
index 0000000..9612011
--- /dev/null
+++ b/hosts/sagittarius/network.nix
@@ -0,0 +1,64 @@
+{ config, ... }:
+let
+  # NOTE: port is the same on every host
+  wgPort = 51820;
+in
+{
+  networking = {
+    hostName = "sagittarius";
+    useNetworkd = true;
+    firewall = {
+      allowedTCPPorts = [ 22 ];
+      allowedUDPPorts = [ wgPort ];
+    };
+  };
+
+  systemd.network = {
+    enable = true;
+
+    networks = {
+      "10-wan" = {
+        matchConfig.Name = "enp1s0";
+        networkConfig.DHCP = "ipv4";
+        address = [ "2a01:4f9:c012:c7a7::1/64" ];
+        routes = [ { Gateway = "fe80::1"; } ];
+      };
+      "50-wg" = {
+        matchConfig.Name = "wg0";
+        address = [
+          "2301:db8:acad:a::1/128"
+          "192.168.23.1/32"
+        ];
+      };
+    };
+
+    netdevs."50-wg" = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "wg0";
+      };
+
+      wireguardConfig = {
+        ListenPort = wgPort;
+        PrivateKeyFile = config.sops.secrets."wg-priv-key".path;
+        # To automatically create routes for everything in AllowedIPs,
+        # add RouteTable=main
+        RouteTable = "main";
+        # FirewallMark marks all packets send and received by wg0 with the
+        # number 42, which can be used to define policy rules on these packets.
+        FirewallMark = 42;
+      };
+
+      wireguardPeers = [
+        {
+          # nyaan
+          PublicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0=";
+          AllowedIPs = [
+            "2301:db8:acad:a::2/128"
+            "192.168.23.2/32"
+          ];
+        }
+      ];
+    };
+  };
+}
diff --git a/hosts/sagittarius/web/default.nix b/hosts/sagittarius/web/default.nix
index c789e20..2ccf36b 100644
--- a/hosts/sagittarius/web/default.nix
+++ b/hosts/sagittarius/web/default.nix
@@ -6,6 +6,5 @@
     ./git.nix
     ./static.nix
     ./navidrome.nix
-    ./wireguard.nix
   ];
 }
diff --git a/hosts/sagittarius/web/wireguard.nix b/hosts/sagittarius/web/wireguard.nix
deleted file mode 100644
index a3eefc6..0000000
--- a/hosts/sagittarius/web/wireguard.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{ config, ... }:
-let
-  # NOTE: port is the same on every host
-  port = 51820;
-in
-{
-  networking.firewall.allowedUDPPorts = [ port ];
-  networking.useNetworkd = true;
-
-  systemd.network = {
-    enable = true;
-    networks."50-wg" = {
-      matchConfig.Name = "wg0";
-      address = [
-        "2301:db8:acad:a::1/128"
-        "192.168.23.1/32"
-      ];
-    };
-    netdevs."50-wg" = {
-      netdevConfig = {
-        Kind = "wireguard";
-        Name = "wg0";
-      };
-
-      wireguardConfig = {
-        ListenPort = port;
-        PrivateKeyFile = config.sops.secrets."wg-priv-key".path;
-        # To automatically create routes for everything in AllowedIPs,
-        # add RouteTable=main
-        RouteTable = "main";
-        # FirewallMark marks all packets send and received by wg0 with the
-        # number 42, which can be used to define policy rules on these packets.
-        FirewallMark = 42;
-      };
-
-      wireguardPeers = [
-        {
-          # nyaan
-          PublicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0=";
-          AllowedIPs = [
-            "2301:db8:acad:a::2/128"
-            "192.168.23.2/32"
-          ];
-        }
-      ];
-    };
-  };
-}
-- 
cgit v1.3.1