{ ... }:
let secrets-db = (import ../secrets-db.nix { });
in {
  networking.wg-quick.interfaces = {
    wg0 = {
      address = [ "10.69.42.3/32" ];
      listenPort = 51820;
      privateKeyFile = "${secrets-db.wg_priv.path}";

      peers = [
        # hetzner-vm
        {
          publicKey = "UJr+EmUM7KWkIy0nk0JA38ibvcLC++6iuOKkHdrx9Dc=";
          presharedKeyFile = "${secrets-db.wg_preshared_hetzner-vm.path}";
          allowedIPs = [ "10.69.42.1/32" ];
          endpoint = "hetzner-vm.servers.genderfucked.monster:51820";
          persistentKeepalive = 25;
        }
        # tablet
        {
          publicKey = "jXA0DeprEaL/ARQ3K81l8xWuUI5C/90DcY3bIfcIjz8=";
          presharedKeyFile = "${secrets-db.wg_preshared_tablet.path}";
          allowedIPs = [ "10.69.42.2/32" ];
        }
      ];
    };
  };
  networking.firewall.allowedUDPPorts = [ 51820 ];
}