From 805e5ee2ae6e82df8123430828b290e099bc854a Mon Sep 17 00:00:00 2001
From: GaspardCulis <gaspard@gasdev.fr>
Date: Tue, 5 Nov 2024 23:42:08 +0100
Subject: [PATCH] feat(hosts/pi4): Added wireguard config

---
 hosts/pi4/default.nix | 34 +++++++++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/hosts/pi4/default.nix b/hosts/pi4/default.nix
index b544269..df87e69 100644
--- a/hosts/pi4/default.nix
+++ b/hosts/pi4/default.nix
@@ -1,4 +1,8 @@
-{pkgs, ...}: {
+{
+  config,
+  pkgs,
+  ...
+}: {
   imports = [
     ./hardware-configuration.nix
   ];
@@ -35,4 +39,32 @@
       };
     };
   };
+
+  # SOPS
+  sops.defaultSopsFile = ../../secrets/pi4/default.yaml;
+  sops.secrets."wireguard/private_key".owner = "root";
+
+  # Wireguard
+  networking.firewall = {
+    allowedUDPPorts = [51820];
+  };
+  networking.wireguard.interfaces = {
+    wg0 = {
+      ips = ["10.8.0.31/24"];
+      listenPort = 51820; # Should match firewall allowedUDPPorts
+
+      privateKeyFile = config.sops.secrets."wireguard/private_key".path;
+
+      peers = [
+        {
+          publicKey = "KLULII6VEUWMhyIba6oxxHdZsVP3TMVlNY1Vz49q7jg=";
+
+          allowedIPs = ["0.0.0.0/0"];
+
+          endpoint = "vpn.gasdev.fr:993";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
 }