5 files changed, 82 insertions, 71 deletions

diff --git a/hosts/mercury/config.nix b/hosts/mercury/config.nix
index a1faded..ef383d7 100644
--- a/hosts/mercury/config.nix
+++ b/hosts/mercury/config.nix
@@ -2,7 +2,12 @@
   collinux = {
     theme = "catppuccin";
 
-    secrets = {};
+    secrets = {
+      "wireguard-privkey" = {
+        file = ./secrets/wg-privkey.age;
+        owner = "systemd-network";
+      };
+    };
 
     user.useRun0 = true;
 
@@ -17,32 +22,28 @@
       greetd = {
         enable = true;
         autologin.enable = true;
+        # cosmic-greeter.enable = true;
       };
 
       wm = {
         niri.enable = true;
-        # sway.enable = true;
         kdeDesktopPortal.enable = true;
 
-        components = {
-          fuzzel.enable = true;
-        };
+        components.fuzzel.enable = true; # noctalia launcher SUCKS
       };
 
       programs = {
-        firefox = {
-          enable = true;
-          extensions.foxyproxy.enable = true;
-        };
-        foot.enable = true;
-
+        firefox.enable = true;
         research.enable = true;
+
+        foot.enable = true;
       };
     };
 
     system = {
       boot = {
         systemd-boot.enable = true;
+        plymouth.enable = true;
         secureBoot.enable = true;
       };
 
@@ -65,7 +66,6 @@
         bat.enable = true;
         eza.enable = true;
         broot.enable = true;
-        tmux.enable = true;
         helix = {
           enable = true;
           hardMode = true;
diff --git a/hosts/mercury/hjem.nix b/hosts/mercury/hjem.nix
index b1ca4d9..75784d4 100644
--- a/hosts/mercury/hjem.nix
+++ b/hosts/mercury/hjem.nix
@@ -3,7 +3,7 @@
     anki
     libreoffice-qt
     musescore
-    (pkgs.callPackage ../../pkgs/obsidian.nix {})
+    obsidian
 
     noctalia-shell
 
diff --git a/hosts/mercury/nixos.nix b/hosts/mercury/nixos.nix
index 764f6f5..5937aeb 100644
--- a/hosts/mercury/nixos.nix
+++ b/hosts/mercury/nixos.nix
@@ -1,76 +1,25 @@
-{
-  lib,
-  inputs,
-  pkgs,
-  ...
-}: {
+{inputs, ...}: {
   imports = [
     ./disks.nix
     ./battery.nix
 
+    ./wireguard.nix
+
     inputs.nixos-facter-modules.nixosModules.facter
     inputs.lanzaboote.nixosModules.lanzaboote
   ];
   facter.reportPath = ./facter.json;
 
-  services.dbus.implementation = "broker";
   services.upower.enable = true;
 
-  environment.defaultPackages = lib.mkForce []; # im not a noob
-
   programs.ssh.extraConfig = ''
     Host ganymede
-      HostName williamsfam.us.com
+      HostName 10.100.0.1
       Port 22
   '';
 
-  virtualisation.podman = {
-    enable = true;
-    dockerCompat = true;
-  };
-  users.users.collin = {
-    extraGroups = ["podman"];
-    subGidRanges = [
-      {
-        count = 65536;
-        startGid = 100000;
-      }
-    ];
-    subUidRanges = [
-      {
-        count = 65536;
-        startUid = 100000;
-      }
-    ];
-  };
-  virtualisation.waydroid = {
-    package = pkgs.waydroid-nftables;
-    enable = true;
-  };
-
   programs.kdeconnect.enable = true;
 
-  services.autossh.sessions = [
-    {
-      name = "ganymede";
-      user = "collin";
-      monitoringPort = 20000;
-      extraArguments = "-N -D 9090 collin@ganymede";
-    }
-  ];
-  boot.supportedFilesystems."fuse.sshfs" = true;
-  fileSystems."/home/collin/ganymede" = {
-    device = "collin@ganymede:/media";
-    fsType = "fuse.sshfs";
-    options = [
-      "identityfile=/home/collin/.ssh/id_ed25519"
-      "idmap=user"
-      "x-systemd.automount" # mount the filesystem automatically on first access
-      "allow_other" # don't restrict access to only the user which `mount`s it (because that's probably systemd who mounts it, not you)
-      "user" # allow manual `mount`ing, as ordinary user.
-    ];
-  };
-
   security.pki.certificates = [
     ''
       -----BEGIN CERTIFICATE-----
@@ -87,7 +36,6 @@
     ''
   ];
 
-  virtualisation.vmVariant = {
-    virtualisation.diskSize = 8192;
-  };
+  # required for vm testing
+  virtualisation.vmVariant.virtualisation.diskSize = 8192;
 }
diff --git a/hosts/mercury/secrets/wg-privkey.age b/hosts/mercury/secrets/wg-privkey.age
new file mode 100644
index 0000000..767692f
--- /dev/null
+++ b/hosts/mercury/secrets/wg-privkey.age
@@ -0,0 +1,9 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyA0L2Ry
+ZXZFOUxvL25CemdScnhEc3Ewb0NVUnBCNHZ5WjlNaDgwMVQxL0VzCmFoWTlQM0N6
+aFBSK05qZ3pKazF1a1BhRDBudkUwQmVpOHNsemUzazV4REkKLT4gbTtrJiw4Qy1n
+cmVhc2UKazJ3UW9zQmh6RlBlTmpmekduUlpMSHl4TGgvcUJKTnB6aE43YTJDR2Vm
+SHZVMGsKLS0tIFpnV21lOE9ZYUtwUFBVeGFWRDVMNFpkSStsSmpIaWZ3MHJVL29G
+dzA2SXMKuuAvweyyyuIFVJftn6tNANBkHp0NGxJZ0LXTj+daziYleOUFn3R1KTVu
+0UMQIZM/WsfesWXkvN1E4+LZKTdNdJOsEJv9ahYnk8btBgU=
+-----END AGE ENCRYPTED FILE-----
diff --git a/hosts/mercury/wireguard.nix b/hosts/mercury/wireguard.nix
new file mode 100644
index 0000000..268cdc6
--- /dev/null
+++ b/hosts/mercury/wireguard.nix
@@ -0,0 +1,54 @@
+{
+  config,
+  hosts,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = [pkgs.wireguard-tools];
+
+  networking.firewall.interfaces."wg0" = {
+    allowedTCPPortRanges = [
+      {
+        from = 1714;
+        to = 1764;
+      }
+    ];
+    allowedUDPPortRanges = [
+      {
+        from = 1714;
+        to = 1764;
+      }
+    ];
+  };
+
+  systemd.network.netdevs."10-wg" = {
+    netdevConfig = {
+      Kind = "wireguard";
+      Name = "wg0";
+      MTUBytes = "1300";
+    };
+    wireguardConfig = {
+      PrivateKeyFile = config.collinux.secrets."wireguard-privkey".path;
+      ListenPort = 9918;
+    };
+    wireguardPeers = [
+      {
+        PublicKey = hosts.ganymede.wg_pubkey;
+        AllowedIPs = ["10.100.0.0/24"];
+        Endpoint = "williamsfam.us.com:51820";
+      }
+    ];
+  };
+  systemd.network.networks."wg0" = {
+    matchConfig.Name = "wg0";
+    address = ["${hosts.mercury.wg_ip}/24"];
+    DHCP = "no";
+    dns = ["${hosts.ganymede.wg_ip}:5353"];
+    domains = ["~ganymede"];
+    networkConfig.IPv6AcceptRA = false;
+    extraConfig = ''
+      DNSOverTLS=no
+      DNSSEC=no
+    '';
+  };
+}