From 11d05469368ecfe533c7720e7f5b624f2f8f19fc Mon Sep 17 00:00:00 2001
From: adikro <adikro@disroot.org>
Date: Sat, 7 Mar 2026 22:27:05 +0100
Subject: ...

---
 os/srv/vpn.nix | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100644 os/srv/vpn.nix

(limited to 'os/srv/vpn.nix')

diff --git a/os/srv/vpn.nix b/os/srv/vpn.nix
new file mode 100644
index 0000000..28c7a9e
--- /dev/null
+++ b/os/srv/vpn.nix
@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.os.srv.vpn;
+  netCfg = config.os.core.network;
+in
+{
+  options.os.srv.vpn.enable = lib.mkEnableOption "enables vpn stuff";
+
+  config = lib.mkIf (cfg.enable && netCfg.enable) {
+    networking.networkmanager.ensureProfiles = {
+      environmentFiles = [ config.sops.secrets."vpn/warp_private_key".path ];
+      profiles.cloudflare-warp = {
+        connection = {
+          id = "cloudflare-warp";
+          type = "wireguard";
+          interface-name = "wg0";
+          autoconnect = false;
+        };
+        wireguard = {
+          mtu = 1200;
+          private-key = "$WG_KEY";
+        };
+        "wireguard-peer.bmXOC+F1FxEMF9dyiK2H5/1SUtzH0JuVo51h2wPfgyo=" = {
+          endpoint = "engage.cloudflareclient.com:2408";
+          allowed-ips = "0.0.0.0/0;::/0;";
+        };
+        ipv4 = {
+          method = "manual";
+          address1 = "172.16.0.2/32";
+          dns = "1.1.1.1;1.0.0.1;";
+        };
+        ipv6 = {
+          method = "manual";
+          address1 = "2606:4700:110:84c7:36c4:e444:5efb:b108/128";
+          dns = "2606:4700:4700::1111;2606:4700:4700::1001;";
+        };
+      };
+    };
+    environment.systemPackages = with pkgs; [
+      wgcf
+      wireguard-tools
+    ];
+  };
+}
-- 
cgit v1.3