From d59022f69d5463df76a1e996fdf091fa3f523457 Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Sat, 22 Aug 2026 10:53:55 +0200
Subject: cleaup, remove unused stuff

---
 wireguard.nix | 112 ----------------------------------------------------------
 1 file changed, 112 deletions(-)
 delete mode 100644 wireguard.nix

(limited to 'wireguard.nix')

diff --git a/wireguard.nix b/wireguard.nix
deleted file mode 100644
index f6c696a..0000000
--- a/wireguard.nix
+++ /dev/null
@@ -1,112 +0,0 @@
-{ config, pkgs, ... }:
-let
-  wgPort = 51820; # Common port used on all peers
-  firewallMark = 42;
-
-  inherit (pkgs) lib;
-  inherit (lib.attrsets)
-    mapAttrsToList
-    ;
-
-  # The topology is hub-and-spoke/star
-  # sagittarius is the hub == 2301:db8:acad:a::1
-  # it hosts authoritative DNS and spokes do keepalive with it.
-  hub = {
-    hostName = "sagittarius";
-    address = "2301:db8:acad:a::1/128";
-    publicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI=";
-    endpoint = "95.216.136.85:${toString wgPort}";
-  };
-  spokes = {
-    nyaan = {
-      address = "2301:db8:acad:a::2/128";
-      publicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0=";
-    };
-    pixel8 = {
-      address = "2301:db8:acad:a::3/128";
-      publicKey = "awBcQzNBdlYWpoOF1n7ijol2EiaJy5cxrVXfrqCvM0k=";
-    };
-    underworld = {
-      address = "2301:db8:acad:a::4/128";
-      publicKey = "GPVOvXqg8rp1a38T6YDHQN6UkG2TJT399A4wNtK4WTM=";
-    };
-  };
-
-  generatePeer =
-    hostname: values:
-    {
-      PublicKey = values.publicKey;
-      AllowedIPs = [ values.address ];
-    }
-    // lib.optionalAttrs (builtins.hasAttr "endpoint" values) {
-      Endpoint = values.endpoint;
-      PersistentKeepalive = 1;
-    };
-
-  hubPeers = mapAttrsToList generatePeer spokes;
-  spokePeers = [
-    {
-      PublicKey = hub.publicKey;
-      AllowedIPs = [ "2301:db8:acad:a::/64" ];
-      Endpoint = hub.endpoint;
-      PersistentKeepalive = 10;
-    }
-  ];
-
-  hostname = config.networking.hostName;
-  isHub = hostname == hub.hostName;
-  conf = if isHub then hub else spokes."${hostname}";
-  privateKeyPath = ./secrets/wireguard/${hostname}.txt;
-in
-{
-  sops.secrets."wireguard-${hostname}-pk" = {
-    sopsFile = privateKeyPath;
-    owner = "systemd-network";
-    group = "systemd-network";
-    mode = "0640";
-    format = "binary";
-  };
-
-  networking.nameservers = [
-    "2301:db8:acad:a::1" # see the zonefile in etc/dns
-  ];
-
-  systemd.network = {
-    enable = true;
-
-    networks."50-wg" = {
-      matchConfig.Name = "wg0";
-      address = [ conf.address ];
-      networkConfig = lib.mkIf isHub {
-        IPv6Forwarding = true;
-        IPv6AcceptRA = false; # Disable RA acceptance on router interfaces
-      };
-    };
-
-    netdevs."50-wg" = {
-      netdevConfig = {
-        Kind = "wireguard";
-        Name = "wg0";
-      };
-
-      wireguardConfig = {
-        ListenPort = wgPort;
-        PrivateKeyFile = config.sops.secrets."wireguard-${hostname}-pk".path;
-        # To automatically create routes for everything in AllowedIPs,
-        # add RouteTable=main
-        RouteTable = "main";
-        # FirewallMark marks all packets send and received by wg0 with the
-        # number, which can be used to define policy rules on these packets.
-        FirewallMark = firewallMark;
-      };
-
-      wireguardPeers = if isHub then hubPeers else spokePeers;
-    };
-  };
-
-  boot.kernel.sysctl = lib.mkIf isHub {
-    # I *think* this should be fine since networkd will prevent forwarding
-    # on any interface that doesn't have IPv6Forwarding set to true.
-    "net.ipv6.conf.wg0.forwarding" = true;
-  };
-}
-- 
cgit v1.3.1