nixos-config/modules/wireguard/home.nix

{ lib, config, ... }:
let
  serverHostName = "vueko";
  peers = {
    issei = {
      address = "10.80.0.1";
      publicKey = "UyZRAVTIc/RMs/J+591wrA8lHU0e8dwDJJwcpRb3xQA=";
    };
    nunotaba = {
      address = "10.80.0.4";
      publicKey = "DvR8mUkll4uyYhNcX82caMkbcw0Lykg8zDzm/3PD5jw=";
    };
    sayuri = {
      address = "10.80.0.5";
      publicKey = "t7hpd2yZupAKHxYerHtXnlPRUjV1aGbrrzjYakKdOwE=";
    };
    vueko = {
      address = "10.80.0.6";
      publicKey = "JbOfL4FxPCzJOjI8AGklPHY2FniCXq0QwOa08gjSyns=";
    };
    fuuko = {
      address = "10.80.0.7";
      publicKey = "VXic8mhaJBSl6yFkx0Cu6JI8tqqjjM3UbW7x+05pV0M=";
    };
  };

  cfg = config.sbruder.wireguard.home;
  enableServer = config.networking.hostName == serverHostName;
in
{
  options = {
    sbruder.wireguard.home = {
      enable = lib.mkEnableOption "WireGuard tunnel wg-home";
      address = lib.mkOption {
        type = lib.types.str;
        visible = false;
        readOnly = true;
      };
    };
  };

  config = lib.mkIf cfg.enable {
    krops.secrets.wg-home-private-key = { };

    sbruder.wireguard.home.address = peers."${config.networking.hostName}".address;

    networking.wireguard.interfaces.wg-home = {
      privateKeyFile = config.krops.secrets.wg-home-private-key.path;
      ips = [ "${cfg.address}/24" ];
      listenPort = if enableServer then 51820 else null;
      peers =
        if enableServer
        then
          map
            (peerConfig: with peerConfig; {
              allowedIPs = [ "${address}/32" ];
              inherit publicKey;
            })
            (lib.attrValues
              (lib.filterAttrs
                (n: v: n != config.networking.hostName)
                peers))
        else [
          {
            allowedIPs = [ "10.80.0.0/24" ];
            publicKey = peers."${serverHostName}".publicKey;
            endpoint = "${serverHostName}.sbruder.de:51820";
            persistentKeepalive = 25;
          }
        ];
    };

    networking.firewall = {
      trustedInterfaces = [ "wg-home" ];
      allowedUDPPorts = lib.optional enableServer 51820;
    };

    boot.kernel.sysctl = lib.optionalAttrs enableServer {
      "net.ipv4.ip_forward" = 1;
    };
  };
}