wireguard: init wireguard service

modules/profiles/desktop.nix

@@ -96,6 +96,7 @@ with lib; {
       openvpn.enable = true;
       printing.enable = true;
       redshift.enable = true;
+      wireguard.enable = true;
     };
   };
 

modules/services/default.nix

@@ -12,5 +12,6 @@
     ./picom.nix
     ./printing.nix
     ./redshift.nix
+    ./wireguard.nix
   ];
 }

modules/services/wireguard.nix

@@ -0,0 +1,41 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+
+with lib;
+let
+  cfg = config.my.services.wireguard;
+in
+{
+  options.my.services.wireguard.enable = mkEnableOption "wireguard";
+
+  config = lib.mkIf cfg.enable {
+    age.secrets = {
+      wireguard-private-key.file = ../../secrets/wireguard-private-key.age;
+      wireguard-preshared-key.file = ../../secrets/wireguard-preshared-key.age;
+    };
+    networking.firewall = {
+      allowedUDPPorts = [ 51820 ];
+    };
+    networking.wg-quick.interfaces = {
+      wg0 = {
+        autostart = false;
+        address = [ "10.8.0.3/24" ];
+        listenPort = 51820;
+        privateKeyFile = "/run/agenix/wireguard-private-key";
+        peers = [
+          {
+            publicKey = "bT/U8ko3i//vH8LNn2R56JkGMg+0GLFrZSF81BBax08=";
+            presharedKeyFile = "/run/agenix/wireguard-preshared-key";
+            # Forward all the traffic via VPN.
+            allowedIPs = [ "0.0.0.0/0" ];
+            endpoint = "wg.moritzboeh.me:51820";
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+    };
+  };
+}