secrets: add wireguard peers

secrets/default.nix

@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ lib, pkgs, ... }:
 
 with lib;
 let
@@ -42,5 +42,7 @@ else {
       ambroisie.hashedPassword = fileContents ./users/ambroisie/password.txt;
       root.hashedPassword = fileContents ./users/root/password.txt;
     };
+
+    wireguard = pkgs.callPackage ./wireguard { };
   };
 }

secrets/wireguard/.gitattributes

@@ -0,0 +1 @@
+/default.nix filter diff

secrets/wireguard/default.nix

@@ -0,0 +1,30 @@
+{ lib, ... }:
+let
+  peerSpec = {
+    # "Server"
+    porthos = {
+      clientNum = 1;
+      externalIp = "91.121.177.163";
+    };
+
+    # "Clients"
+    aramis = {
+      clientNum = 2;
+    };
+
+    richelieu = {
+      clientNum = 3;
+    };
+  };
+
+  makePeer = name: attrs: with lib; {
+    inherit (attrs) clientNum;
+    publicKey = fileContents (./. + "/${name}/public.key");
+    privateKey = fileContents (./. + "/${name}/secret.key");
+  } // optionalAttrs (attrs ? externalIp) {
+    inherit (attrs) externalIp;
+  };
+in
+{
+  peers = builtins.mapAttrs makePeer peerSpec;
+}