nixfiles/hosts/tablet/profiles/wireguard.nix

{ ... }:
let secrets-db = (import ../secrets-db.nix { });
in {
  networking.wg-quick.interfaces = {
    wg0 = {
      address = [ "10.69.42.2/32" ];
      privateKeyFile = "${secrets-db.wg_priv.path}";

      peers = [
        # hetzner-vm
        {
          publicKey = "UJr+EmUM7KWkIy0nk0JA38ibvcLC++6iuOKkHdrx9Dc=";
          presharedKeyFile = "${secrets-db.wg_preshared_hetzner-vm.path}";
          allowedIPs = [ "10.69.42.1/32" ];
          endpoint = "hetzner-vm.servers.genderfucked.monster:51820";
          persistentKeepalive = 25;
        }
        # vault
        {
          publicKey = "IGq+WanFM/bKNUkwjO/0AAtDhJLvtvU+mVxH27QyHTc=";
          presharedKeyFile = "${secrets-db.wg_preshared_vault.path}";
          allowedIPs = [ "10.69.42.3/32" ];
          endpoint = "vault.servers.genderfucked.monster:51820";
          persistentKeepalive = 25;
        }
        # storage
        {
          publicKey = "biNNeCkjAWi2jUVoL5+1pBtXGa3OFZi4DltB2dqGjGg=";
          presharedKeyFile = "${secrets-db.wg_preshared_storage.path}";
          allowedIPs = [ "10.69.42.4/32" ];
          endpoint = "storage.servers.genderfucked.monster:51820";
          persistentKeepalive = 25;
        }
      ];
    };
  };
}