diff --git a/modules/services/wireguard.nix b/modules/services/wireguard.nix index 977c6c5..d919803 100644 --- a/modules/services/wireguard.nix +++ b/modules/services/wireguard.nix @@ -5,9 +5,37 @@ { config, lib, pkgs, ... }: let cfg = config.my.services.wireguard; + secrets = config.age.secrets; hostName = config.networking.hostName; - peers = config.my.secrets.wireguard.peers; + peers = + let + mkPeer = name: attrs: { + inherit (attrs) clientNum publicKey; + privateKeyFile = secrets."wireguard/${name}/private-key".path; + } // lib.optionalAttrs (attrs ? externalIp) { + inherit (attrs) externalIp; + }; + in + lib.mapAttrs mkPeer { + # "Server" + porthos = { + clientNum = 1; + publicKey = "PLdgsizztddri0LYtjuNHr5r2E8D+yI+gM8cm5WDfHQ="; + externalIp = "91.121.177.163"; + }; + + # "Clients" + aramis = { + clientNum = 2; + publicKey = "QJSWIBS1mXTpxYybLlKu/Y5wy0GFbUfn4yPzpF1DZDc="; + }; + + richelieu = { + clientNum = 3; + publicKey = "w4IADAj2Tt7Qe95a0RxDv9ovg/Dr/f3q1LrVOPF48Rk="; + }; + }; thisPeer = peers."${hostName}"; thisPeerIsServer = thisPeer ? externalIp; # Only connect to clients from server, and only connect to server from clients @@ -26,8 +54,7 @@ let "${v4.subnet}.${toString thisPeer.clientNum}/${toString v4.mask}" "${v6.subnet}::${toString thisPeer.clientNum}/${toHexString v6.mask}" ]; - # Insecure, I don't care - privateKey = thisPeer.privateKey; + inherit (thisPeer) privateKeyFile; peers = let