{ config, ... }:
let secrets = config.services.secrets.secrets;
in {

  networking.firewall.trustedInterfaces = [ "wg0" ];
  networking.wg-quick.interfaces = {
    wg0 = {
      autostart = false;
      address = [ "10.69.42.2/32" ];
      privateKeyFile = "${secrets.wg_priv.path}";

      peers = [
        # hetzner-vm
        {
          publicKey = "UJr+EmUM7KWkIy0nk0JA38ibvcLC++6iuOKkHdrx9Dc=";
          presharedKeyFile = "${secrets.wg_preshared_hetzner-vm.path}";
          allowedIPs = [ "10.69.42.1/32" ];
          endpoint = "hetzner-vm.servers.genderfucked.monster:51820";
          persistentKeepalive = 25;
        }
        # vault
        {
          publicKey = "IGq+WanFM/bKNUkwjO/0AAtDhJLvtvU+mVxH27QyHTc=";
          presharedKeyFile = "${secrets.wg_preshared_vault.path}";
          allowedIPs = [ "10.69.42.3/32" ];
          endpoint = "vault.servers.genderfucked.monster:51820";
          persistentKeepalive = 25;
        }
        # storage
        {
          publicKey = "biNNeCkjAWi2jUVoL5+1pBtXGa3OFZi4DltB2dqGjGg=";
          presharedKeyFile = "${secrets.wg_preshared_storage.path}";
          allowedIPs = [ "10.69.42.4/32" ];
          endpoint = "storage.servers.genderfucked.monster:51820";
          persistentKeepalive = 25;
        }
      ];
    };
  };
}