From dcb2d428d774d9084e1939aaf61b7e69510e22ef Mon Sep 17 00:00:00 2001
From: Dmitriy Pleshevskiy <dmitriy@pleshevski.ru>
Date: Thu, 2 Mar 2023 16:00:19 +0300
Subject: [PATCH] machines: add wireguard vpn

---
 .agenix_config.nix                         | Bin 2867 -> 3835 bytes
 machines/asus-gl553vd/default.nix          |  10 +++
 machines/canigou/data.secret.nix           | Bin 0 -> 53 bytes
 machines/canigou/default.nix               |   2 +
 machines/canigou/services/wireguard.nix    |  62 +++++++++++++++++++
 machines/default.nix                       |  15 +----
 machines/home/default.nix                  |  13 ++++
 machines/magenta/data.secret.nix           | Bin 0 -> 52 bytes
 machines/modules/nix.nix                   |   2 +-
 machines/modules/wireguard-client.nix      |  68 +++++++++++++++++++++
 notes/vpn.md                               |  13 ++++
 secrets/wireguard-asus-gl553vd-private.age | Bin 0 -> 1607 bytes
 secrets/wireguard-canigou-private.age      | Bin 0 -> 1379 bytes
 secrets/wireguard-home-private.age         | Bin 0 -> 1524 bytes
 14 files changed, 171 insertions(+), 14 deletions(-)
 create mode 100644 machines/canigou/data.secret.nix
 create mode 100644 machines/canigou/services/wireguard.nix
 create mode 100644 machines/magenta/data.secret.nix
 create mode 100644 machines/modules/wireguard-client.nix
 create mode 100644 notes/vpn.md
 create mode 100644 secrets/wireguard-asus-gl553vd-private.age
 create mode 100644 secrets/wireguard-canigou-private.age
 create mode 100644 secrets/wireguard-home-private.age

diff --git a/.agenix_config.nix b/.agenix_config.nix
index 057da6e31686b3e4b4b1bb08046e790d25f3d8c3..00829bef89ae537314b50e8921ef13743425e4bb 100644
GIT binary patch
literal 3835
zcmV<X4g~Q4M@dveQdv+`0H*KzRMwlfd;RAX(ir@k^S?#IQ38xeJCQQ@>0OPGDsG4o
zfz@_*>F1{pxrct2JQ0Pb5PQb%r3?yZEtwM=z;u{YjDMv=uYTaq39eKX2I!j48XuAK
zTMMVt;q7!wey_1qS>-+v{Um%Lc=|*bC}%Bi*x*O^>axG{$71fnG3d2hs%-Mh{h$69
zVPhwO@5*)w9fttanW-`28!2;BGjd!BbgAY`Rb0ws<z6hq($OR_&BI0MnmEENZesiK
z-aPNmFBqlkM;(8}`lzRfI~TOb9s}_&p;>0&Qa^m&T2Nuw7t38i-0oztC^s-k&Rn9M
zSAY}#*UFXp6;?t=E|d-GzcPIf6v@NHx;Z)t7&l!}#@Jgi;v33PJnj=Xy2R2>S+*jA
z^JaOddhKdOxyf5?W@MXWOu?%d0o(4OLqG|B6iA!?dH6*N>dLCSGA2QzS6kH~PQ_Hf
z=WhQNQ*h(%vpSvdL9?mqyL(7V-|Nec!;&uOdJ!SQm#qI?cnL9`aD8z45g7F~wWq+>
z%hT5UUuFT0WRAT)|A!m_E~YE5)2J$dUtG;Ly+R-K{8_uC>~Y7Sv{mG{@Un1GVzV9g
z%2~zhKVqmghYWOwcSJ22=`Roz1rN-{e|>cu)3Y5Si`x+Oz|sJ9@Og{N?7<6~lyw6&
zi<HcaBhn7tZKdC83ruzpI?Q|`Z9*9-W?aKq+(v+(fNU@s;BXLU&a0mnyt|vWSfAGD
zw)*OUO4`&nc0zi!+0n3@wwn4@3siCMnc0j6do@}320k`Upw@Bek|prRUMnyrrNlmQ
z|Bqwd+n6Kp(NoTb({ND2F}AZfR~slZ%-1yQ?sUJjy_KU4wb4){Xjikehop}7KCu@(
zect-9oyQb5!-B~59U!jkIO@@BVMKh#i~1S3+z6qZ^(j-yzA!p99*F{!r;Y(C4bZ6-
za;8fuQR&^r$^4F8SYs>#Ifgc7OSgQ$cGn&=O|MlW8&<5>4b{auvSGlW%Hcc7xAsCR
zYApB4<DN8ycMe>B$DG;kG`pzyS+<$%XByV|UCslzy?EV}-v`9kSw69BbPrdVkn=xW
zdtLnwWO0Uur-PUy1f11T(v_pwXU9Ta$XhBG8f2fGQCO#iGAr+O=9MgLJIoPo#lJk8
z$mx{mK9y*PoG9SQ6nf8F<GpNeAzpZU0NCPN7)$lZMj>ba$FsK7*8_T0k+q-Q`kh8&
zk;$7<#AtxS&vOEGbPbRuUb3}(e4*N1daVL3`)@xmCQ$;JpJMEXE~h|5_9O23;nz4>
z#KO|PEJ|>X1LRZqU-e*4z>(^SkuEv^kE!~Ln!bo;@_7dv8(M+D_#}Hg-nR^bsMqG%
z*RlB1`<^-+mMLxHD;(%0cnMG7kzce{&>_*M5I{M&8~3sgL%yIR?x&kD-Xo1Nv`Gei
z%~Ht9rta5nv{P^F2cg<};X%I}OSnGfK(;P>jswf*$11Ac7aK)@as?7hc?*8I#{;eR
z;f)R0mcWIk=iTA)g>M6&d-VWn3CQ-}w)u#9|J(dDH0o<?3fbdtHd;x*SypqEB+L@P
zy%~?hR0>4jpSDe2>jR(zo3sm^>LI9{SO;3We11(!iKir49fvnYj;Z?*t}rDv{$Zks
zZ#Jffq50sL?@ZE}?|Rs=fP?S{eH(s`KeCc~^_*M-{UGT>q6`AYnhmQDH3yN$>$%}h
zr(&b1-|M@{wtq5>c78v+848eY>F)`{4gmtgt4&3To}3G?{;S1sGz_P{o#E__5I6*%
ztAzq4zY9e1MkcJz`s}I$6652YIJ@6=@l?VP_gN`f_~5SrmTzn^z6Ew3oJUy+A+w)^
z_OAb;7}`DC?oZ@U_hQ-P*{#|(d1_VO#KG4!f)<TC;hc!Ev`B^P7$x28E_|Gn9S92%
z5nhvN^?TaL2Cz98IBr0y1tFGN&(g6JjP`Egmgp^D1|n<5=FKhG`Ixm!7#&_`cerr7
zx4lGbb3czZ(UFTvb#B!e)6JT%bGEA&_m{(iW=ict036gi-V(!;(6)Z~ng|E&8IiNd
zzooq9Pt-Zje8;U}RP4@s7OKW|*zUhxtmnw2g*mE)?~wy1&DJO`GOeHgkxLr<F6t`1
z%N#|mO3W-uhpZtt4MjG656nF$s)!eJc1c~%k4Y1%YWDsMv>~3^En6?{<fre>k~7J7
zXG8+6>h^g1uh18O0L8f+V;0$$?`s@|=m8z{PhGhY?Bmn813F$SQn1@|yF3By1%C<2
zxC{@l^?gUsmab6tR$o1KRMltcX+79@h8r}9>_DjA+Gw9X=Y!1w8L<y8o16!lI6H5s
zB)pz&Tzy`?>CQli9e5q4S(}H7TnS6s*T+1bWI7y!VsNz6FJjz0TznVmZ0WM(ME@^Z
zN*#L;9Y6$d(&ZiVIDNWzz}^7EVmrmvT|;{_mo4OAZnuytb&sisuIkd-gAUOWO6s`v
zyrUr1j+dHyEfDtElSh3Jfb}E(*h5roznqi2=W904=y!Go2clA9lM@?icmC7p;-npC
z3_jvdi}N_Cf^a9-AADzv0X*;XTCUia?Hgw`c&JXQrSm{ppOF+$_i!5RxUp$ibpNz`
z3#eEczMm0dWtU6HJhsgB1yOS8%-ezeS~|E|P?$mQLqscUwFl88F3Gp031=qL1v%;1
z=$k$6x~%X)BIkaE;_40RX;nZA&aKV=R}#(`V5XR(V_1(C)`fEUG<CasANg6@=CS{Y
zp}XL>hyq?N;J$GWD89F!GlrXzM%GPJVAo29dNXt<85AMbwz<rStlKh!6<j<yZOIUS
zF&={hX!pBw#T?u@W%ubg`G=NjhKPlfMsbP=$9cjEheS~C1duuAiWOqj<c#Q>m$e68
z9=|HMhxv)#iUkDX6$ho^Fw2HC+MOEK@o7_@+UP3Wclhj4Y#GG#01^0)OOVGVoj6iS
zAS(bqS!+q@?q+)6SYV^Xdb7>AF=9ysKi{r#a2WQpPNsrkq^f#OjW#=8!y*a;b1%PX
ze*~%j`W6l<wzO8cvVC!zhRvwwQ*J&b2-9{Ma&=j8%}|%MQv^mlJI4&lLxK5Jw;p1!
zkGNB*r|oDawy-}RwN>BeC^BNRc|7jpU?QfNXc`vBXQ9OLEh8Bx2U63w0(;P8VaXs@
zo~j@6B8uMR<>`ytJw%_xC<J%e&?gasEcKpG7d$yiP9Z<t*Wkdl<`JPocLZ+y9#OF*
z<Nm^rNd1WdGS+}s>n9{qu0t?<ObPA<3ea!tfa3_O(3Q9Tr=1ABZooOQNuBIproQC1
zV2@s*rr8ZZ5>qf$`2o_d+VYHiWoKQSzAPs-T&MVZYSB7Cr^};Ei^u+N<YJ6*18ln`
zGK7lzZ0}5uMzr7?;VN%}c6=?JM!*#WE4@k4Opf<gOP7*X`X<L+DRc$T=RtARd*++v
z8dH<8KmoIr0zOlV7^5h`LZMj)_?u+JwMI6I<gng4$c7p{^9O4bt@nvBwpy6Dr9;py
zg&PdLQLZ-cOy%^j%l-%nVXcn#s4NiKqMg0FnRRC4zjaFqWpbQ$u{!J4yaJUExrK(%
zOH&SXjt595L!UPp6xj`6qj2hgk2P)($7Bi`nGQ}5^Ol>d748#^F%@Oge*n@r)cg+E
z3{I;d(#_&0!C`E84wGHll#wlut0r+|4gpHggloM8rguED$pB^p7q=6t^>s}a^bDaL
z?)Fh7$kmSt1KSs2z5h%Vb#Q1>dMVf%xf`~%w!Dz?`1C#*t4y%1shHof>(KO+C>4SF
zr?TK#U56bkGaC>+{?AL*o7SfNRhHiwHR%WC`G<w6D9^i3G4)u00a>}^-%UbNLgdFZ
zwoqT?R+ighDJoPmnFr55;R+OpQ)h=%cnof}%(cd!q{t#Mm?fkp;LFOLS^&Ukef-H6
z9kV5&t5ru->u*j)CY>X}gG(-<&H4G6_7GUkIxfUlr4FeRiW$>cuzZd?CvAN&!Pg6F
z5GY5H8`*|r09qE)p*A&m;+TB4bwS->`6ql&7@Rxqx1W%$TFIP^RJu!AVuxqQh(o7p
zZVM>B4KE!D_&}?qSQHGzILKM1C^8nBR7An|koC6W|Mw~F$YoCn=hKZw+)Vy#B2VoN
zgdM+TX731YiqG9nr>cfX2Q86d{H2;-4>pMK!IrqK`H+6-=>M=X*N|`i2G7QK*Eeuo
zDJm_h@Iq;YC!Wpb7Ti=9xCe;D8w-Zts#A$v4V!IT8Orbp6X_}DooTZWjcS31?^X_2
zy$fHd&Aoxjlnx#{FLm8`3n9d;a-|Dyn_9EWh%@8x(KCJOL#Y7=%7f<jG~!6uc<Is$
z%Le5@d>FSx5JkUaOt+XRE+W=X9NCVu7IgGX^7Te^eowJ!p$5qs0pk&UzP6s~>^)!A
zkbZjVJ&K!6yiE1QG}uu$Pp-50?FK0w-Ik@IFa&~TQus^tE|?rv9KgSN%4`$$>x>b3
zQ!uyJ>GQ_}&PD=L+Vr}*H&`LFYb7oI_no040SJqPu3qKUa2{9_Bn<2q<}LQiMZ5&@
zbDp}Ld{2O(*INR{u79ktD{u}s?M@AzZW?_q6Z6=FSW}gt1XoHN^(la$lm0KHH<;RY
zBUWFdvE`SIl_C;*3~_GRPj^tu4tOlkE(!IvSnG|RdBwmo_q~d|$_Eqf`&*t@w+CeC
z2+RhW2mnRJO1Djkk4todpP=SejawDlPVW!2f>k9W9r3e&R!?@;y$<<EOYE@^*rv!C
zFlyibwvn#QO3lf|m^7m^TA*7&-R8GO)iUnB!L{9iP=Z)}O+#?-870|R?d0#&^dF0X
zqe_!$kx3#(ImFpkvl~K}sv79Mv&a8W-l?#eq3ZAu5Lx$EPPP`Kqd*zG-S!2J)1Y}M
z{SW&;jYEcAN$OGYUe~<2OW*Q=1e5`7dtRcpsZJQ4gIPvKs7pPg+_{d$CBj2ToYw?m
z@lIdP<-iE{xSn?xSYXn-Z>=!W9>D3xB3dU~3j)|@Dr~@}D~VHcL%NW6SK+el0?&TY
xeh%pxU6dR5>7`2W!P0aOP_sPIMoROk@dA_()^VO!7ycfS1W0zrvlkuR1B<l+gvtN_

literal 2867
zcmV-33(WKYM@dveQdv+`0Pm^{cmP@?|ImbwgU~})>O&l20q8j+IdO3_gkPr(oug_D
z>v605gnF^1Yy!{oQR@Q1p0Foz7Opga!E80<9l6%y+Q438f1_m}#MEb@0)MI7ih!*a
zUZ`!`H^Dg|^6g0NfUPFdPtSrM_7+cG*Jh5fC-fXSgU#(9Oj*g3FvDT?HWR-Qp<OMu
zFpi<Z+cBk7N$EI%ZseT<5?>YSg@02w&kURf{iuJXI}5B0S7q_-B_)e!95XdiMJ3`j
z5_if0b9|z^uaQ@#pTH5-3vg(jw*yuSaINCG8x=DwE1E($jehW&oVJwIoPrgXzm@_*
z2W<ry1vNS|diX`^hh?!>6ab~C``hZ`9<S-zsA350d!jd>)j_#(T~2IAZ8IdvIdr38
zI3su?2<Iz;M7wVi*1B_eaU%V58<lZ+=Y3+*XD&{QV=AJBf|s&G!CB6^m2Hi(j}@u&
z_muIPMl%9zHY&%@)TeqjU^=g^O9^o%D+f;F3@f(&f+fZ0n<4e_R7%d<h+nn}uD|2d
z@iRYYKJpBf@n?xH9@N(=Q_Gt#<gnwai!jK-DD}K9HdTvxD1Hw!O)=(+QefrI{Qcjb
z8TPQlIQ2x22S|O<SR9qZqPL%MuF~l%G;%Tcv|@Qm9|gulm2pKsJoCC92|2|p<F0N~
zpaqg<4b6El7td!6F;0t`tDiG-{NDhpI`Y^dG<4hEO|ORl=5mW&hk}%G<TS$?_mr5Q
zq>Ke}dr$h_O%*|tH*CoH%=Ym6;>g!?#MawowyFvKhs@0H^sQSOo^K<47JeznYAMgU
zawEWVFJ+9C^i;Ok5EZ)9Sq<Rep&bN}Ci?oE=yyU%Q)55H77v2KAhHWgyzWO?T)w>8
zq0Zg_0u-s#IQdvtzDun(76Gm^dg#w2*X6i{_CMg|@R`Y_VY9nILLcG-@;an0AiWHd
z&tie^a}o$FQ_7@z+S&<w)GD{9=Z~vJxbxF(6w>0axAT$I+;02S9SQru`n)wl!iEm~
zrPiMWC~=~`5va$l<?RquujG0!{9S5XT=fF|Z-XQkF4Xo?R%?Vo!LlwKt7FUHs(Szs
z-<%f)Qfw_=G_S(zUkHi#yIWE=x<SC}u5{Z^jI-fzjnZ~Yc|W1iMY?51CJHxfPnTfE
zyj6SFw+7tKGpD5ZQ2cr&Mn$~_bU}6r#x`v;#*n!*B$f!Atpg9?2=P~`=TP_5-5v^%
zX9){2t}t^Bufy?JA%r*liyPP!^K5GxG0~%i0lc~Rtn$`x?x7rgMJw@xLL4Lo=Vill
zaFZ&#Y`|CpzI%@8`1h2fzNJEFk2G|jw#_&G&JL(%6#(n*<OnA9dX7P$EHxjf1G}$m
zn`v@k<~w@^aP!|3D+1@WRdxh1F?7F72NormF7%Czax8C-`=N!Z;pSY)JZTEIq=s~U
zC=;i3eb!c8SVtMfN0J&gCqGcmzzA5CqA8jX>f63afmZBKk}aP%t}~kz+Ew3tvh#w3
zP*;3?mFIq{u6wdp7DQ@6v(^+YB=oG#G3l$dXBBRS8wA70zVgBCzd8L4cKvuKtvz<}
zZOmR{j!H%veUr3;x^fZC5-nne8|7ET&8b-N&-d5Dl{=oG{>aJnqL^?6<bym418039
zTedgPR5DYFqGVjh#?`}#E<N9NSo^JLeM{X$Nl8M#0D5x&xL;*>{|0%!XkOmINwq_a
z(E|{<#nD*L_sln*@DKuRn=h_9K}Wv3N_Jua;_s&0nB$3`zx1Y{_wjtqvsKW*OFoT|
z#Y<+@e}>0yQs2l*i&t~#jcNk{&q-HCv}zv3kb#SWe0vwu<s#xsEg}vHGyMp$@>Ip7
z?xk~fKz~`ifcg{46wyAnRk3Ay7qjSPY$lZZ6_G1Z83{9~e|G7_4+DfU>LA@MokP*P
z_l}$<iqvc1O&sS-1P`miI0&qwbBZs5c2U&&FtzR~Bq=sHl$!v>$lk2|K;5&1A>?xA
zLj9PO%XbhOX9$?bG+>zd7HD1+^29ZPB_*agG)?4!E==B;%KqWTKFwW0cbBHSFyG*{
zcHU+4d$h4m9jHyj=%Q{v2bN&3kBrOBf`~e^+~Z{EvI~gCAR??9hq!tEy}GvoQy<+O
z$6S>xU5j+1fg3lCm%}eZ{2Vaa{%dVb|5W@IbW^JYEj)=n2Rg>ccG>ItZAls*6MmNU
z9u;8y)mFD7<+9%y!s=|XRg5~X8RcyO`w6EYJ6_=hLyJsU=9DqB8Htd8bVb)!y7j+K
zXAMb3J1*nWJ2qClvbK_pVAC=<>XxlW?m#*2_*?-b8Cyzl*hbkAmsg9SFHTa9cp?vE
zgCcqGPb(qidbeCyRIx07r$b-?J+X-ve~htna%aSD9j=Fgf%93@_K?rT=V%v6Y~hPM
zM{t;3&24Zt;uyya)0A-_Yiiuh)8k#wSj2+P$Kr>7cd)2|9fuO<N}<Lnt;6g#WTa10
zfx=qhytdHX7PKy7LksTOmO<-UhTh`uY>Hjpgvv_>HhODc-w-aP!UISb_gZ6@zX;nT
zHMS#|F7rrc+o&_OcCW9OQAHLb2JxgeAsx8SmUeSqEo<0_ydciuJ(3a3n_YIeF{ECG
zp?cf^R0Va(pEWMCwlpgOIx-PjkPgYqjVmwbZJ^TZtBs@(WIk`?!o7iRX{zOpr+6Uq
zF!ppToFdq2J{CSw>mkp<%j#b7BkOoCiNIZCpt>OGtAC(*L2Y73@*|G_t1Zg0C_A11
zWx+%a{1tdR$g>o={bt|ix_Lu)RkkCICcdQXH*v_cG9(Uoao4o0`g`X;a}j?j5yvr0
zrt@Q}Z12+}P#RO%rM-y9z~{-V(Psgqro$DY^v>+8;=Q10z5Kr0QKwINboih&u8pfu
zR9dV0<VO~HQM}1$G|NdSOVmf}r)Ui;fG2e{m!RLpROb(R8BFL+I8Xm=bbO<ha|jpT
z0!piIKsWN;WJ4lAQZQE05l*<7<*~Fjr$y;7dx_%%Uh)Cs3D+2*I(ybWYLN(|4mCv+
zYcQ1WudxF>Ws+#?QChej=f(o-k(%+nhZ}>f%U%z)a5&n{ijX8TH)$23#bi(?oVY;A
zb*D$NIBNZ!+R5yYxZ<2*vfDjMn#K{0tPeZOWP5x-%6xO>(v@)Lfh+5WLZ~p7BQL@+
zF=AJ5K!#(Qu=s2KuRAtyhkRsUONsK=<}KKh`W;qC>@8Ea2CcF>AKs8H1zrfx*fcW(
z)3Cm6T)Er)RL9vkn1ePJ0}X<#>j;jc$COOJFKkb4+FW?t`lL6p#vA&XR<K+`9Ol9w
z;?$zZaQse}1b=3`XZ#vA{*8Y07#8Aa>e_-$DR%;8g4F`D`n-#f9hvKaWR>QZv=Q#2
zwP|?5Whq<{M^xZ9N!>HP@th61N;q0QB4I}?tZ+0HCpMfAQ>4u4s&EuwApPLB6?8Sp
z=bk|*<wADBzn&tbu|D+h+<vojJz=A@6ip;h7RJI~LyzwAOE1METio*8^rf@v*S;2?
zUE}<nd~uc&6Ov!=Tq`tToRp+gX)*rolurO0ezPDFAP<Mu-OB2p_2gW4+hUEHD7ISz
z8Tj;<`cZs62<ayq?YHxDP=5DorF4+tlnB(Vh8tdno?Uw%J`n?zSa)PDhaX^zDT6~K
z`nO`n$%WC^eLq{1r|&)B2Fj>En%`mFjyQ1O^f-xX)pTQL=$)P$X8d%iJm@tA5`Dp9
zT*3Dvp+n`<N$>i><FM}ouwn(4VD&ul?mL$2Cx3ha`rL&HB%qm-c&wPc_Js8ZXZ@!E
R$4=n%=09-R&%(~3QTMpooDl#3

diff --git a/machines/asus-gl553vd/default.nix b/machines/asus-gl553vd/default.nix
index f0f3e8d..aa0390a 100644
--- a/machines/asus-gl553vd/default.nix
+++ b/machines/asus-gl553vd/default.nix
@@ -12,6 +12,7 @@
     ../modules/nix.nix
     ../modules/garbage-collector.nix
     ../modules/networking.secret.nix
+    ../modules/wireguard-client.nix
   ];
 
   # Use latest kernel
@@ -65,5 +66,14 @@
     localDiscovery = true;
   };
 
+  # Additional nix configs
   local.nix.enableMyRegistry = true;
+
+  # Wireguard client
+  age.secrets.wireguard-asus-gl553vd-private.file = ../../secrets/wireguard-asus-gl553vd-private.age;
+  local.wireguard = {
+    enable = false;
+    ip = "10.100.0.3/24";
+    privateKeyFile = config.age.secrets.wireguard-asus-gl553vd-private.path;
+  };
 }
diff --git a/machines/canigou/data.secret.nix b/machines/canigou/data.secret.nix
new file mode 100644
index 0000000000000000000000000000000000000000..468c5f4cfb46a548cd74f87f27554e6ecfe540f0
GIT binary patch
literal 53
zcmV-50LuRWM@dveQdv+`0Bmh<#f&1*hNfi-m9m4hH_aA%Oc+T}{F)zO^dM;z;_WNo
LJ*nvyy7FT+Ij0v_

literal 0
HcmV?d00001

diff --git a/machines/canigou/default.nix b/machines/canigou/default.nix
index 24ee8dc..e036aac 100644
--- a/machines/canigou/default.nix
+++ b/machines/canigou/default.nix
@@ -10,6 +10,8 @@ in
 
     ../modules/common.nix
     ../modules/fail2ban.nix
+
+    ./services/wireguard.nix
   ];
 
   boot.cleanTmpDir = true;
diff --git a/machines/canigou/services/wireguard.nix b/machines/canigou/services/wireguard.nix
new file mode 100644
index 0000000..3806680
--- /dev/null
+++ b/machines/canigou/services/wireguard.nix
@@ -0,0 +1,62 @@
+{ config, pkgs, ... }:
+
+let
+  port = 51820;
+in
+{
+  # enable NAT
+  networking.nat = {
+    enable = true;
+    externalInterface = "eth0";
+    internalInterfaces = [ "wg0" ];
+  };
+
+  networking.firewall = {
+    allowedUDPPorts = [ port ];
+  };
+
+  networking.wireguard.interfaces = {
+    # "wg0" is the network interface name. You can name the interface arbitrarily.
+    wg0 = {
+      # Determines the IP address and subnet of the server's end of the tunnel interface.
+      ips = [ "10.100.0.1/24" ];
+
+      # The port that WireGuard listens to. Must be accessible by the client.
+      listenPort = port;
+
+      # This allows the wireguard server to route your traffic to the internet and hence be like a VPN
+      # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
+      postSetup = ''
+        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+      '';
+
+      # This undoes the above command
+      postShutdown = ''
+        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+      '';
+
+      # Path to the private key file.
+      privateKeyFile = config.age.secrets.wireguard-canigou-private.path;
+
+      peers = [
+        # List of allowed peers.
+        {
+          # Home
+          publicKey = "Gg+p7tysAhu2X841weBiQrqoKXh6kvcmDiCY62rLwQg=";
+          # List of IPs assigned to this peer within the tunnel subnet. Used to configure routing.
+          allowedIPs = [ "10.100.0.2/32" ];
+        }
+        {
+          # Asus
+          publicKey = "mzVH0N3q7UE/XjMwgRks+D8KFuIj91VkOK2ytgjsnkw=";
+          allowedIPs = [ "10.100.0.3/32" ];
+        }
+      ];
+    };
+  };
+
+  age.secrets.wireguard-canigou-private = {
+    file = ../../../secrets/wireguard-canigou-private.age;
+    mode = "0400";
+  };
+}
diff --git a/machines/default.nix b/machines/default.nix
index 768fbc4..9bb2fb2 100644
--- a/machines/default.nix
+++ b/machines/default.nix
@@ -2,15 +2,6 @@
 
 let
   hardware = inputs.hardware.nixosModules;
-
-  inherit (inputs.nixpkgs) lib;
-  inherit (builtins) head;
-  getTargetHost = file:
-    let
-      net = import file { inherit lib; };
-      ipv4addrs = net.networking.interfaces.eth0.ipv4.addresses;
-    in
-    (head ipv4addrs).address;
 in
 {
   home = {
@@ -46,8 +37,7 @@ in
   magenta = {
     system = "x86_64-linux";
 
-    targetHost =
-      getTargetHost ./magenta/networking.secret.nix;
+    targetHost = (import ./magenta/data.secret.nix).addr;
 
     extraModules = [
       inputs.mailserver.nixosModule
@@ -57,7 +47,6 @@ in
   canigou = {
     system = "x86_64-linux";
 
-    targetHost =
-      getTargetHost ./canigou/networking.secret.nix;
+    targetHost = (import ./canigou/data.secret.nix).addr;
   };
 }
diff --git a/machines/home/default.nix b/machines/home/default.nix
index 3f5d42a..c42e23b 100644
--- a/machines/home/default.nix
+++ b/machines/home/default.nix
@@ -12,6 +12,7 @@
     ../modules/nix.nix
     ../modules/garbage-collector.nix
     ../modules/networking.secret.nix
+    ../modules/wireguard-client.nix
   ];
 
   # Configure kernel
@@ -84,5 +85,17 @@
     localDiscovery = true;
   };
 
+  # Additional nix configs
   local.nix.enableMyRegistry = true;
+
+  # Wireguard client
+  age.secrets.wireguard-home-private = {
+    file = ../../secrets/wireguard-home-private.age;
+    mode = "0400";
+  };
+  local.wireguard = {
+    enable = true;
+    ip = "10.100.0.2/24";
+    privateKeyFile = config.age.secrets.wireguard-home-private.path;
+  };
 }
diff --git a/machines/magenta/data.secret.nix b/machines/magenta/data.secret.nix
new file mode 100644
index 0000000000000000000000000000000000000000..e85018391743cf51cd7fc80f5dcda345506574bd
GIT binary patch
literal 52
zcmZQ@_Y83kiVO&0NaMU=oWA>Gy-?z%9#8k==xL(f`s^<Adi8d7C^A=9hXrlE`pW!9
I<n6pR0P+qM7ytkO

literal 0
HcmV?d00001

diff --git a/machines/modules/nix.nix b/machines/modules/nix.nix
index f239a3b..b913962 100644
--- a/machines/modules/nix.nix
+++ b/machines/modules/nix.nix
@@ -12,7 +12,7 @@ in
       description = "Enable my custom nix registry";
     };
     allowUnfreePackages = mkOption {
-      type = types.listOf types.string;
+      type = types.listOf types.str;
       default = [ ];
     };
   };
diff --git a/machines/modules/wireguard-client.nix b/machines/modules/wireguard-client.nix
new file mode 100644
index 0000000..81c5807
--- /dev/null
+++ b/machines/modules/wireguard-client.nix
@@ -0,0 +1,68 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.local.wireguard;
+
+  port = 51820;
+
+  serverAddr = (import ../canigou/data.secret.nix).addr;
+  defaultGateway = "192.168.0.1";
+in
+{
+  options.local.wireguard = with lib; {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable wireguard vpn";
+    };
+    ip = mkOption {
+      type = types.str;
+      description = "10.100.0.<num>/24";
+      example = "10.100.0.1/24";
+    };
+    privateKeyFile = mkOption {
+      type = types.str;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall = {
+      allowedUDPPorts = [ port ]; # Clients and peers can use the same port, see listenport
+    };
+    # Enable WireGuard
+    networking.wireguard.interfaces = {
+      # "wg0" is the network interface name. You can name the interface arbitrarily.
+      wg0 = {
+        # Determines the IP address and subnet of the client's end of the tunnel interface.
+        ips = [ cfg.ip ];
+        listenPort = port; # to match firewall allowedUDPPorts (without this wg uses random port numbers)
+
+        # Path to the private key file.
+        privateKeyFile = cfg.privateKeyFile;
+
+        postSetup = "${pkgs.iproute}/bin/ip route add ${serverAddr} via ${defaultGateway}";
+        postShutdown = "${pkgs.iproute}/bin/ip route del ${serverAddr} via ${defaultGateway}";
+
+        peers = [
+          # For a client configuration, one peer entry for the server will suffice.
+
+          {
+            # Public key of the server (not a file path).
+            publicKey = "nFqvL30dkKkhOt+fLJ+EJNmp9GjkXVjmpz1WRI1pG0A=";
+
+            # Forward all the traffic via VPN.
+            allowedIPs = [ "0.0.0.0/0" ];
+            # Or forward only particular subnets
+            # allowedIPs = [ "192.168.0.0/24" ];
+
+            # Set this to the server IP and port.
+            endpoint = "${serverAddr}:${toString port}";
+
+            # Send keepalives every 25 seconds. Important to keep NAT tables alive.
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+    };
+  };
+}
diff --git a/notes/vpn.md b/notes/vpn.md
new file mode 100644
index 0000000..07e2c6b
--- /dev/null
+++ b/notes/vpn.md
@@ -0,0 +1,13 @@
+# WireGuard
+
+## Generate keypair
+
+```sh
+umask 077
+wg genkey > ./private
+wg pubkey < ./private > ./public
+```
+
+# References:
+
+- https://nixos.wiki/wiki/WireGuard
diff --git a/secrets/wireguard-asus-gl553vd-private.age b/secrets/wireguard-asus-gl553vd-private.age
new file mode 100644
index 0000000000000000000000000000000000000000..dcb8766edb83d67be44c9017fa5a2b6ef3fa6931
GIT binary patch
literal 1607
zcmV-N2DteEM@dveQdv+`0O&jCkdDL3OgrB=-%E!5PSmrKJf4b#n{$VR7c<bhCSEh9
zh+LVDMqi}!&&hnH(AzG7Djr_w*bzH(`rMH`5+*VEpeHI2#;IW*wHDT?6x_s8-$yso
z(qLT$hHNVW@;}O7@Kh&Kj}HhXf+`JEI&c@{jk%KsgqQZ5fB~7y+X_btZ0?mH;X1NF
z_#=6Scvk#>B^$r^3SOqQVE#(E$4IZt#+O|j{6~)x7PTvEiJxXFlDZwOEJtGYNSt^7
z%660upSn4^+a;Way#bNY5kMn}CGC9Jd75J|lRFtEZ0~XgZaocA(xVMhNlXFS@yF-c
zvGH>`!CB3M3Tz0C=TN!~@*qo`=7?5%?*p5zg1zHl^=<iz#f&m(mbAVy%HHAs*Y-%X
z;ze}1s2p>vT?4FEK9-WOdoH8$X7bjE_p>Q7hTl#p7ms#{#@Qmr<x_g_Q;=hwa%;<u
zP8-H%?!Kyb|Gs}bvi-_h7l~T9K?rTu#}w1xn=rM!sj<~p(Y+Ia;mMSFnk;3*U2z#`
zE-%u!a?k-4K#_Y=mYFP?{tJ7%ksoRwf|}zN7?A~3NLj7_Y0g>eaYFWWlS>5UBHC^4
zT_=NYH;pYwr^r~)MHh)1SMX4CQOm||(H*p|;o|c6v{n9Vcn7W?m^;$Bf*9CSCcMX&
z6SR#~mG0Wr9A1DBI9)iA#Rc#H!<F=XlUB{FHhCs5K|HhSDZQ86(Lc*UkiI)~hk@Uq
zCog&ZSKSkN1ODt}RAYs#mi78OL~6zf0oD||GRD0AgsgS}zalqy#%J}n*Flql=4Z`c
ztM_BB4RxigFj<QXgO^qTKz{ajke*XvEQERcosIT3Lle#9=(s30%t0|;agt}`t|F~@
zzWdSl3(5ko>rvf{!@h<bThFL^F~q~zk&IzZ%Ggq}`qJF{!nXH9?XoETpaZBZ`^adL
zF~I}IF{s!DyQYm9sK2|=;8x?g)}5);K<;^+%l0t9TAlV>raV|`2d*apaBl2gM=n|H
z6iUbz<CB!_@VkDWKD2~cQU-ZE`qB`wGK%g#zv#4J)W1x}X_DP8!S!S51^!xxlsar<
zGAx`djGJ`r5G@;>=(FK{5|rZOFzXcp?Rx$6B=XiSuw=5IkJ*N;x5x_X2+IQ;wytWv
zL!Lv=DT9@KDS>`<cnMZQh#@lscS3-T3=>F|R4)-nip%E;$h@61UA*<t(yV#aDNQLW
znanD<Zw8etUlX3_{*xa%Rq$Vj$QG8lCIj8yFU%R$IQQ%0*)%o<;cd6JtM*Kn5AEhq
z@cSez2(({DGy|(ykeV~H-qPE+SqaK$Ui-&kB4h}2a|Ykn%+hncMqm-iB4OB@9*X0R
zW}Wc^)y;)#EhOrgsyhrMMu~!!?B-?tizA4t-KotWd1chxw(<L9H$B_Rs2v_3-{sSK
z3|U4c)QQ*=CW>f5piQOMx0cdUk<Uz_Xzb)j(Rm&dhZ^qg=Q&wAu&BvH1kSlkN!Aq-
z5?_$I7vuOu-T5SJk3wWCIh_p#y#Ap{FPZAzM_5>50_h(VZ$`#yWf0Hj?>}hZzm69B
zSjP>YgFh39j$K%5DDI0^PWRB<&5{YPMWSI%F3q8mJoj)JhKeeytme^Fd?J@8mN5eC
zqe*^mQtFC$G^lcgcRi9y9E=Nkco|h&d#g;i`Db^0#P7I;b6@g6X4vJuw_%gf9b5u7
z$czauaXu=78qm2*=G+xY;CDI?TUm=|N+tiaOPSY*mU+Ml#-7m<jT-mUDw12PA7{Y%
zfSh3ux~jg%f7fk)?t~4bK8-{&wjxtoXO6rNKC<Y4$(Ov@kB85ErIH&*+(r{HUO7bZ
zPF-;~vlwEcQPuzzG*~<y^;eJ@6gdXWXwEbICF%^HNget;dzo@UhztP{iMRe;1f}gw
zEet3fvV&`?bn*-b2mud_yp@^9r_Ye4@Jx{gjk=(F(h)ndAZUc&L{z#yWo<rN?l)mV
z$0t&iX_09ef_xYasPGA|^oZ}R<&BG|G$^i2RGCA`atJa;mLe4nlFm$tatA!a{`Ot@
zfDoA7aWeh)eGdnuIbq>B_mrT0Xwk#=*lF?V2+%=wep|ea)~`F*{{WyWHG}hP1V>J6
FpzI>^BrX5|

literal 0
HcmV?d00001

diff --git a/secrets/wireguard-canigou-private.age b/secrets/wireguard-canigou-private.age
new file mode 100644
index 0000000000000000000000000000000000000000..d8baa18e97cd90183de8ee4dba89cb2cff4f4a82
GIT binary patch
literal 1379
zcmV-p1)TZ-M@dveQdv+`0HQ*z;y;g*{WH}1)$=i>(AH`Y1|7phnQhl6y)>-wH}*MT
zqlV_EH=06Z6T#Ia+HLe^!D`Th`5kkOD`B36O1O~{7qHndg(H5AgYV^b0Q}D+fHYX{
z<S<^LVcb;IA6JO=I@%8nD2y&9k7d1^a#Qbh2Z*HQIRPik`iD(MS$jymt7xRuwy5ix
z$PR}pk`|D{X<>}&9E|-hc#r!%Fn#09k47%F?H7=ENus6<WB#Pu97XAJ<kca|%QxoI
zjPv{r3d?mmMYxLY@2=pf$N+v*KF6I^ZT{hnyf@B3_FbHsuR^kmHr*)ViO|mjL=B8s
z<0MO{1P=!iH%ampa66*o>UFT!yBk68+iILaZhe*^$B~ZFd$t`8xpoB6`q{?@en&Nn
zE?otB6TUT>@o4YxsV(u^l_!TlQu)S)Qg?etnuFhsJR)t=<%)R%HS2P@<!l`$c|k_c
zFN(<gpP}FY<h{iQwCG-<PJ*f24MB3Awkqk{t}uOEqG40X)Pjrn$u8|pwqC!vTE$_0
z0JH2^P5}Modh~cU@Y#ad3$hed1#53G?icE8B`${@xz_r{S~~(OOciZr2hyhHat)9v
z39G+FzBo4MnDI~EPfz?E{~OlQT>~d5Nd=tih)0wq0}M<86&xqRS<;YhZhd+u-8%A<
zz7{Y0U>YSga0De2ha||89}kblVhBRHr7*hL(a<M1Afg)QLt;2A9?JQUNEJ;ick<Je
zVjDZyiM@~QzFG1m#?uP|^|)KJ{576&1yU2?bG4h4jrToXjS8xLql<bbAIV-Ai`Pj6
z7yrf2R>x5+5s3+%X{UEuwmmGl%NXLhGQAB$mjz<k`v9WtR3g-EWr13E{)eA7e-Xne
z$Y!1w4S5g61cCUjNFrG_NWk}~C_uQj@Afq7ocRveGeYvJN!=qBKy_=e=#NLjvIyZz
zzg(`+@ccmO-sAmWwSR}ZWD32?>a{o3az{;_#3q+zQQI0?4HATE-v4RnVlA#YMjG7O
zI1oQO=Ohul%4jTBg-m<U9IxPE36umMRBZMqBVA)r85Km6r%i`RSHB+EHjMSdBv2GM
zk182*`)&+%d(Pc;1$+y3a~ey`_fDekP~t}6zgs07hA)M@c2UalT&O{BYHT*_K<-41
zYD3N4Yjfh%Dm=RYogKD>>Bm5_8%>-)FN!LL!#iQ{R@dI}q3yeWC0^+nCGs&_=~UA9
zC5cNKegG!+L`Qy>v3D?tS|v_RX%^l?yF~WxyQQ*M7c^MT<2mW|b@dCb?zKudk~Bqg
zu%uEUWZZR>qSgstBqYW*(f3~w0bho}Sr`B8URqd%gHA~CrbamWSLwZMzow;m!wIk}
zetFL#dfdYK1;3u%hk4d~E3!c@TS$6Zbo)+u%D5=$`)|8LpY-|@Mm{=p%QE#Uy*UT$
z{`6xx9*^E8q8x3u=)o;!=SGE4u=u(~+?2v}l9sHrek$qn4ee|>5xC0ceVa+}D`=EQ
z38VQg%MmduB|_cX=T`Pu<><MSerz?Hlf+nXc(r;yyXzwcfiF3YS|rQCT>kxh(w+gf
zIUWETxOtB~;Cd|Jhb;jfq||+=)QiRxynP)IA+@ZQ(pVM$EeJO=B>7Q##-4sUC?eq;
zuE6CCpr<TKV+PUXfvAdk6a#DJwd6H`$&}zQDRC8!@sp8aB1-g`=lWej^{ocpw?aD6
zDiBNa3vn1G+0fHT&1A}8#=BaAqZJ-%AZ4;h`p*NCsjqQc#=A5@Kjtqa6CRkFrGoH1
lt*iOg)HO<+@n6)5_S8pmP$LM5^{Pquk*irJsgOa9rpeSYsqp{+

literal 0
HcmV?d00001

diff --git a/secrets/wireguard-home-private.age b/secrets/wireguard-home-private.age
new file mode 100644
index 0000000000000000000000000000000000000000..f78a9d3f1664734b5087b56348c017d29f67e170
GIT binary patch
literal 1524
zcmV<Q1q=EBM@dveQdv+`09Cr}j=X5v6&P|6E6sQd0$V%RaevR$XzT-F_aUHcZ5rp)
zI?k~Ucivy3In=XBDr4BMiQ%p9rFgiN?w|bE!?WOHq$AXFeStGVd>C9U{QO$COY3k}
z;15!WC<~zmVg*d&c|ENaj;0-vz0yceF8l>{Zz=de!@^-f#5f9ftWXe|K;)6rNTsj%
zie3=UmhnZQ!^a!3%!>)5Nl~rTRu@?5*^6(F9?FQ1yIg_l>-JvMj1FDTvT&oJDZ?}E
zQsZ-|kfJk|E0HoG_xQw>y%AP}Rh&xHB@&)ZxYv=veSEf`PkM=y_(Hm^L7pj%M>_+%
z);x>8CQP}>{(bC-1nNb(Q=5Eo=PjRL-T6BF>YPC5U#89(W*83BT+39>rL9?Z0Yt*z
zT54wGvH<T6I)fuG_MBf^fMH7vh0LZwM!P|3zx48&r||EHk8!s>(N3=2-|C})|E&^>
zY>%q<l8i&hI9eX<Xy0Rg?@NpbZK1_N?7{i+ZowL1rRl!*;Gliy+p}qQsiEqc*gSc<
z{F_ip@g(0Ma~`sjN4xoFG^3`Ds2XFV6U!7hR~cIK%g;(g_+B<+FveE_%ACff2J6Gf
zSK>$Ijmd;#6+m!cS+oM()RISH0Kg}|0K>`u7zcWZVD#kPH}YDKcy`6r7^E&eWwl-;
zAGVk|vr`*I09}a`taft(xDU?#OF7`ggz<}e#X??@HhWjT(sm7txW)Jfs(oTHCz05f
za@@rkv5t!=UV`g9s0gMeJ~J7Wfd5C!Z(z7fdF1_=?V}NB74^=-ruLa0SnHUmD*dIO
zPk`12YIkg*mQ$mX2n7(bCf_3k>gZ<6uMj{h4E2h;YqItUQ#{RBja3f@th|)Z4;cjB
z^<-*O>FMvCYvt9>-szZ(!(E+ENxLh?-Z>|=4LDa;d!<F3uX_d_#)Dx!JUp}O0J``d
zQ-B7wh}#<n;i0MCXd#~Sy`5NGVoS)2ko1(;{Vuj?Zs$oahVdStO5N<=upq+-O)909
zxns(GxM)oRJ;KHJW0R<QO$`v%9itG5&~@`VS?l`7HmQ-BEOMr`!i#g^p%ejU5=NZ2
zW)UeU4EZ)rM)-qv7Zn}aq%l<%RJWY)2QII96+TNS#7~g&WXF=kq&>qP7wrc81D^Oz
zt_imhLunjtRUDYd3`MHV{AIM`+Mg_QWandJ3C`534hc06FihfiDO-AtSd;e2Upa@V
zd*K}G>sTD3MY4&GJS)RqtIq}R7Vh^vxSZ<0eO{QC;^abn<}6;wWj}yL`TJgSW{myp
zNO6z4-KkJZO6?2_;;^V)09tD5&o=M>kK4AmDy&p-5CaI_jY(WJjS^Fv1Jbngi7Fb*
zW5#5l<()kKaeskM`g4}WYd5@EsDyFvK0y2K28CflvIiOb;Vt%u1TQ)5wGX-PB;JkL
zf$Zj5P589bV=@g|V#t(gT8Yw7UD^l47=R4^1pA|3P6EMC9@xKYWSS-$e>U7YK%LNW
zCC`=L$6eM%^SDJZGgqJ?CCqX;q3pzO>##F$u(;Mt`XWZ+6BorQf*cnOJ$A3F;HObc
zH!ndnlw9JraNUdg8%QIfR(0JAAN6X`Nv~+QC_X{FQ3^t$RdZ@4)|a_1)7<G@Y2^D^
zR7dv7kME;>j{@}TAG=MG@~$c5)CEW;!SDEZf}W)tfdBX|x6V{+qwTddu=kPKd_7M#
zJk~4a)?pNrw4eTb+1SF8lTpfk8d^^wQKIuVCE$n|oS3<~y{axVtpRRnM7w-SAm#9T
z%H$1WtfV)8z$$WfUe+sJ3mc5JxF0X(5mcH#Zj!S@;JNV9OF6bfz<g8`o@FTB<9ywU
zBu@=t+-X^u0mCENVuik^QN=(prcg^+;H?D={4^YPO<(K@UxfErju52zTkk1ynKjNl
z*^fTEPBg`Z2_@|z8`&fE-6iLhw7-&j^4~uhDWW1Jwt_ntZ<H#WRWPBxLuf+;%yg&k
a+|#{h!O&=6{maO_AQ7QjqSvAgAUk2=b^?3=

literal 0
HcmV?d00001