1 files changed, 49 insertions, 0 deletions
diff --git a/os/srv/vpn.nix b/os/srv/vpn.nix
new file mode 100644
index 0000000..28c7a9e
--- /dev/null
+++ b/os/srv/vpn.nix
@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.os.srv.vpn;
+  netCfg = config.os.core.network;
+in
+{
+  options.os.srv.vpn.enable = lib.mkEnableOption "enables vpn stuff";
+
+  config = lib.mkIf (cfg.enable && netCfg.enable) {
+    networking.networkmanager.ensureProfiles = {
+      environmentFiles = [ config.sops.secrets."vpn/warp_private_key".path ];
+      profiles.cloudflare-warp = {
+        connection = {
+          id = "cloudflare-warp";
+          type = "wireguard";
+          interface-name = "wg0";
+          autoconnect = false;
+        };
+        wireguard = {
+          mtu = 1200;
+          private-key = "$WG_KEY";
+        };
+        "wireguard-peer.bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=" = {
+          endpoint = "engage.cloudflareclient.com:2408";
+          allowed-ips = "0.0.0.0/0;::/0;";
+        };
+        ipv4 = {
+          method = "manual";
+          address1 = "172.16.0.2/32";
+          dns = "1.1.1.1;1.0.0.1;";
+        };
+        ipv6 = {
+          method = "manual";
+          address1 = "2606:4700:110:84c7:36c4:e444:5efb:b108/128";
+          dns = "2606:4700:4700::1111;2606:4700:4700::1001;";
+        };
+      };
+    };
+    environment.systemPackages = with pkgs; [
+      wgcf
+      wireguard-tools
+    ];
+  };
+}