nixos: services: wireguard: add VPN conflicts

It's now easier to do the right thing when starting a VPN service,
whether the other one is running or not.

modules/nixos/services/wireguard/default.nix

@@ -261,5 +261,11 @@ in
     (lib.mkIf (cfg.internal.enable && !cfg.internal.startAtBoot) {
       systemd.services."wg-quick-${cfg.internal.name}".wantedBy = lib.mkForce [ ];
     })
+
+    # Make systemd shut down one service when starting the other
+    (lib.mkIf (cfg.internal.enable) {
+      systemd.services."wg-quick-${cfg.iface}".conflicts = [ "wg-quick-${cfg.internal.name}.service" ];
+      systemd.services."wg-quick-${cfg.internal.name}".conflicts = [ "wg-quick-${cfg.iface}.service" ];
+    })
   ]);
 }