various wireguard fixes

4 files changed, 24 insertions, 8 deletions

diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix
index a7a68ea..7b8fbea 100644
--- a/hosts/ganymede/config.nix
+++ b/hosts/ganymede/config.nix
@@ -9,9 +9,11 @@
       };
 
       "caddy-env".file = ./caddy-env.age;
-      "tsnsrv-authkey".file = ./tsnsrv-authkey.age;
 
-      "wg-key".file = ./ganymede-wg-key.age;
+      "wg-key" = {
+        file = ./ganymede-wg-key.age;
+        owner = "systemd-network";
+      };
     };
 
     wireguard = {
@@ -21,7 +23,7 @@
       privateKeyFile = config.collinux.secrets."wg-key".path;
       peers = {
         "mercury" = {
-          publicKey = "EDDppGqbLfEwEcHLP3J+bxKVGW16fAcU83K/ZKR2h3A=";
+          publicKey = "dU9CI6OQr0nJXb2JCy3SgqcraK60zuQzFJu3iHG6AAU=";
           ip = "100.100.0.5/32";
         };
         "jupiter" = {
diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix
index 6680967..47e3129 100644
--- a/hosts/ganymede/nixos.nix
+++ b/hosts/ganymede/nixos.nix
@@ -1,6 +1,7 @@
 {
   config,
   inputs,
+  lib,
   ...
 }: {
   imports = [
@@ -15,12 +16,18 @@
 
   services.tailscale.extraSetFlags = ["--advertise-exit-node"];
 
+  networking.firewall.allowedUDPPorts = [51820];
+
   # backup usb teather configuration
   systemd.network.networks."80-usb-teather" = {
     name = "enp0s20f0u2";
     networkConfig.DHCP = "yes";
   };
 
+  systemd.networks."12-wireguard" = {
+    networkConfig.Address = lib.mkForce ["100.100.0.1/24"];
+  };
+
   # i broke something and this fixes it
   environment.etc."systemd/resolved.conf.d/10-dns.conf".text = config.environment.etc."systemd/resolved.conf".text;
 }
diff --git a/modules/wireguard/nixos/default.nix b/modules/wireguard/nixos/default.nix
index ada218a..706048e 100644
--- a/modules/wireguard/nixos/default.nix
+++ b/modules/wireguard/nixos/default.nix
@@ -23,11 +23,17 @@ in
 
         wireguardPeers =
           cfg.peers
-          |> builtins.mapAttrs (_: m: {
-            PublicKey = m.publicKey;
-            AllowedIPs = [m.ip];
-            Endpoint = m.endpoint;
-          })
+          |> builtins.mapAttrs (_: m:
+            if (m == null)
+            then {
+              PublicKey = m.publicKey;
+              AllowedIPs = [m.ip];
+            }
+            else {
+              PublicKey = m.publicKey;
+              AllowedIPs = [m.ip];
+              Endpoint = m.endpoint;
+            })
           |> builtins.attrValues;
       };
 
diff --git a/modules/wireguard/options.nix b/modules/wireguard/options.nix
index 94d62e9..c3c574f 100644
--- a/modules/wireguard/options.nix
+++ b/modules/wireguard/options.nix
@@ -31,6 +31,7 @@ in {
             endpoint = mkOption {
               type = lib.types.nullOr lib.types.str;
               description = "peer's endpoint";
+              default = null;
             };
           };
         });