nixfiles/hosts/hetzner-vm/profiles/wireguard.nix

{config, ...}: let
  secrets = config.services.secrets.secrets;
in {
  networking.wg-quick.interfaces = {
    wg0 = {
      address = ["10.69.42.1/32"];
      listenPort = 51820;
      privateKeyFile = "${secrets.wg_privkey.path}";
      peers = [
        # vault
        {
          publicKey = "IGq+WanFM/bKNUkwjO/0AAtDhJLvtvU+mVxH27QyHTc=";
          presharedKeyFile = "${secrets.wg_preshared_vault.path}";
          endpoint = "vault.servers.genderfucked.monster:51820";
          allowedIPs = ["10.69.42.3/32"];
        }
        # iphone8
        {
          publicKey = "2BgT08bDKh8WlFFSeRArI9a1GpFgUyqEApvJy4KgAmw=";
          presharedKeyFile = "${secrets.wg_preshared_iphone8.path}";
          allowedIPs = ["10.69.42.5/32"];
        }
      ];
    };
  };
  networking.firewall.allowedUDPPorts = [51820];
}