From 1eba5398fd09f98bd11cbf8c3b80f20bb9ce1f2d Mon Sep 17 00:00:00 2001
From: adikro <adikro@disroot.org>
Date: Fri, 12 Jun 2026 00:53:25 +0200
Subject: microvm and dns stuff

---
 os/srv/wireguard.nix | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

(limited to 'os/srv/wireguard.nix')

diff --git a/os/srv/wireguard.nix b/os/srv/wireguard.nix
index 15675a4..363ac9f 100644
--- a/os/srv/wireguard.nix
+++ b/os/srv/wireguard.nix
@@ -27,6 +27,11 @@ in
         default = "eth0";
         description = "The public WAN interface of the server";
       };
+      publicKey = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = "The public key of your primary WireGuard server node.";
+      };
 
       peers = lib.mkOption {
         type = lib.types.listOf (
@@ -93,17 +98,16 @@ in
                 iifname "wg0" accept
                 oifname "wg0" accept
               }
-
               chain postrouting {
                 type nat hook postrouting priority 100; policy accept;
-                iifname "wg0" oifname "${cfg.server.externalInterface}" masquerade
+                oifname "${cfg.server.externalInterface}" masquerade
               }
             '';
           };
         };
 
         networking.wireguard.interfaces.wg0 = {
-          ips = [ "10.255.1.1/16" ];
+          ips = [ "10.255.1.1/24" ];
           listenPort = 51280;
           privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path;
 
@@ -129,13 +133,12 @@ in
         ];
 
         networking.wireguard.interfaces.wg0 = {
-          ips = [ "10.255.0.${toString cfg.client.index}/16" ];
+          ips = [ "10.255.0.${toString cfg.client.index}/24" ];
           privateKeyFile = config.sops.secrets."wg_private_key/${hostname}".path;
 
           peers = [
             {
-              # TODO get the server public key
-              publicKey = "";
+              publicKey = cfg.server.publicKey;
               endpoint = "${masterDomain}:51280";
               persistentKeepalive = 25;
 
-- 
cgit v1.3