From 040d7392dc17baec4bc7f13824cde2bc3b86b93a Mon Sep 17 00:00:00 2001
From: jimjam4real <jimjam4real@gmail.com>
Date: Mon, 23 Sep 2024 13:49:48 -0400
Subject: [PATCH] Maybe unfinished support for wireguard Nix clients

---
 secrets.nix                  | Bin 2674 -> 2892 bytes
 system/desktop/firewall.nix  |   6 ++++--
 system/desktop/wireguard.nix |  23 +++++++++++++++++++++++
 system/pinebook.nix          |   7 +++++--
 system/server/wireguard.nix  |  14 ++++++++------
 5 files changed, 40 insertions(+), 10 deletions(-)
 create mode 100644 system/desktop/wireguard.nix

diff --git a/secrets.nix b/secrets.nix
index 367d785162902d4343db91248dc1e8cef0ca696d..c1098f85b5173116ba4bcb0e0b7043990ece35cf 100644
GIT binary patch
literal 2892
zcmV-S3$ye9M@dveQdv+`0Q#Ibmn}Sb{!~V(nw3LG@=OyO3ZAG^z$pduwF%)oq~DWF
zyyoKX_ldxiH))LR9<7`LsI`Bt9a{IBb>D}|K!s$u`a%fy1c>1vO<*ej5eRg!L!dWZ
ztXm5y$lBa-4U5L*?THZs!2gV2G&Xu}2`XR}?!2D3_Bt=I8pD6`0NaJWvn3=fci2qk
zj8ZvU{bP@%|C{5L5oWuK9ETM9jL(4j2L<ACKKC|f5QXHWT@HK~s-07>8BX@g#Ce1I
zkA(DY*{KMdo`ZZDaO4UBdkRh1w6A@NDXe7<yY3?a%l&h*tC-$-xPd?3hY+)667a|6
zV>XinkA@CCtb)M@3@+7+jCDS@3Uj`t)3_JsuM#?{=k0egl_^3NCE-1V&3LRx8DUGo
z<Ok_>VKk{&1hTZUwDLDP3{~riaJiwdy5LVEW`co4UK_3RM$6;*_}o%XG<i^WH1x~M
zuZc%bH4>ngsNWpA;gPPeAEeqNGNMdq24%$b=C5R0T?k_s-|HJX;bgf7MXX7OU*qi^
zff5|sL44wXU;Ksj0KM^Nd*_)yT^(Eb3y>Q<0UI8t6wj_R2|xHz#Lys=#T6PwHn0AS
zmpAx5cHFD;32$n?GUiWF*Sp||+0rGEA>qdOED|4kn;P4tZTl&c6tbJfRtz307?BOI
za)0yNRJAN~P`XL9U86`?P+DHCa4x3go4@HLdFRlZ!=$4s2!o!NnNJca?~;y8I~gfX
z8eGa~mp>6>W(7gJ`pe#iiF839<RTrqVz{(-^Ev&&%QVX=RZDX>JIxsgbc=_@nFxkX
zze!d0lm*4zVBLHwIafnPXOqu2JvLR4XG6hQ4Q0$iK+RM;XwlpMC}h)hVdOY5k^SbT
zhMP*VcyRt~aMTZi=B&zT9bJ1YC?~|d98{wxD3fkZ8ywyA?geu6>H?UqI$!!o^2AV4
zrEIcf;sg5YTvAyL@sR(8IknH4qfWxh=Ul@WyL+*(A?|<X;^q?nP`5GlJ7J@+KGfe@
z2spZP)c%xh9)lnKLm1cyz2|pMVG+U9rn=Y-^T^;0dpYU}>NXwPWQ4krxEP{L9&D!g
zrfZd8qOTmZHcgjTH%a_MMG+M9P~0{>Nrri8o0ex^aTkjNO9}d3_?KEQTA%`2)AzUN
za>b6=iSVdw<~AsMXKfK9LE4adV?=Hj-LRHIiHI=nI$4t()M%HGlT0v$mGVW2gxH+L
z!7QHbP8vpv1re~)CU?^{n~2Hsm#SlvV=4}u5uShun)ut<;^rcx_fcseU6=h7JO>?<
zC?!wPWLD#k{YSNhQU7lTvqlpCIlPCD&x>B$L|yg5t`RJ11tSD-6<ZyC>iMQqeP=20
zSUudg-lKSWMeY09dAydj1>CK&Tty=-amDdDFgkl)cV4g0s88TWSwf*cP%}%@lh0vc
z;;#-MPG#VWmbqmp(_`NmlU`y5;Xf$Z|K{3}VD%Ky*@+$c$Q7mtAlN?4pwPC2<ToxQ
zV(=I_!*?J#9HR2LKvIq;Jhb7ptSn%qiWFis*TJ2Nr1pC0w_O+vAft`mwk*V*t^ZWP
zla+$8zD9vt&K9ioFM}MhVB-PE2(R3(jgU-`qo|-B`D_nH9Ih<ETz=#IRV+=A4<x8)
zD?|#@^cm}8OLrXqj^bkMN`&y7_)%oS;z@eAp}0L-9)!HV&eJ;3ogP5PHP>d?lcrw0
z=d>_4ewb`Lb{)~D1`KnItn3^R&{>J*XV2#d<S{=k1H+E8@$BL)5&rV_)3jQy#Sfjc
zgE!F@!w6<2M+AVCo{DU)Jbfnw%?2rClZ7vy3^;ho|NV3m{^8LHRovIp!9LBIs+~{&
zEk4<VEUd+3V|-Ag+xRcH%R_UYZw3nF-=AaYSY3SV=voVt#p;SZrKIoVi@QcZjw3RW
zWUZLr`Z{#?iozE^1P=*kgwap;k3n@)jU;U2F&xr$8TC{n(KjxV=qXSIr-HOO7Q2at
zhuTC$SvNiw%yMu7l6|j#2H~<l<U*ovZHZcTy64IOgX5uqUm)j#3>P|L2t<}?K7w3H
zDs>RgGiwXBMpp?6Y#qC@8;yGiW1u+Xr8x#5u-+L7uZzYNnW4h<a}01BagoV*tMGg?
z`~mHxWma1#3N|W8_TX9Knx_whz1)iyv3A%5JP!Ia2j47qDwsP*7BU}W_tqmhu{*k<
zv}m?P06meQJRKFW@5U03LMxK;RbY=l^EQGn{jma?dQ0&B?6toxr4UBwQI%<cTzB2&
zKq>JcM^wbpV#VLd1Eqp0f!$f#amGzV-%l5p6S45iO)Xj-s4n4&0ko!5q?}G8tq%25
z8=dXZnH%y|R;?#hxMkSxtJ(?+g?Yh@rlrY+OH%8u2XuRER)IwCf7z5jjrPZ_swKp6
zwVjYpR#k3?V$O4j)N{w1$5{7JaYb_C@(fwX8I#qI>_#KmICFqDLuonz9&xnl?VtHp
zqJz*<CoF1{LP3<E``q_|6n82a<*4uITXb4Y<M3P)u}5J=bKya%GpYxY_{;FalQ*Ut
zTHjARb>IPfbsuL2nJ~hoP;Blj3@lFs`9{_ui6BIHs<GhBlXBB>ij~U9aUS$H?e*p6
zW4>I3RF%sp6D02#-T;h8RmTa{qb|g2L{x(nowsoxvnjddgiA1(<$EfAD3!!|g;WTj
z;rV;}+b61b><Vs72J*4<eVv!H0I+p@L$&zk@?E<G9tY2$4I{^?v$k7(nqY6F)}euc
zfg!>TYP_(1c4)3PZ!<_l7X8=a@`;HoCg1?iCvL?|zjrfyf_@^zh?(kUov}K(V=mYA
zo?Up&cIC+9<z19qgJ>B9U8{5A3Dgwz%ZGX#=@jwL10Nf-UGp#v7X#!Ry@*~*7p*>2
z<Y;isUMlmdh)p{j-t{-P8M*-w**ct_LYEVd=2sMWSBUA9;Ng)h*Y%N2wOj`fftB+l
zC^HAuecouHK28SlERTDL6#7vGbpuQ_pO*Ee1(n-=UddJzFMJD>^{2t`(}TxGTwlSY
zK{XI|k<w}w@OrGHHt0K^$ASiqGhwl>mmazJ`fa<IhL{s~TMRnUd19^pls?NaK+(Y!
zv%aicP{*3v=AMWuc)jZ&qmd9B5v7R^Vb<q*#l~(V7}c(>fZv}m6pQl`AF))RF<Z>v
zt(~$%U=-^g&kW&<ijxsGm685@YxT4P7u|bK$}ab;3M3Q~Ua<zz%Tj0G6m`6bd1p77
znW-a7%yuE}$`COuoD;G31GRs}{srGxk_0vEL*Jj^>t^^26RXC=Q6?B44~Ke6Tg98Z
z2I{8+45yEU_E=r%i8}L{%>kaGNCu=KFWt(UXiizGxwQ*dlS(_c<PS0on!&uf>EIuy
zd;hy)e|EUEL@Ysy1z){xh|4ow-^qU=YB90N*`S4PLg43TXl&RC<iCO?*A-JFLJ;UO
z!Dt`UG#f2oUNiL4elrf=#Ctd#dLkNzBiDOj2V>`I=>h$&D<lz=L6Ii%dZfzAA^&EV
z8mc>*Ab|R<f4~*>nT0e?%CTtQ5k@YnN#OZRs$E|{1+kCMR+<R(Co2*ED_k*c7_iqt
z5RvL~&oo2|iNk6n-~JCbuVWr$wIQv6T|k-8ZMvhEkP|4KvSqNTRnG6f1=$CQztd^R
zcn1NrFHRs)QL@kubEULYSZ96k!YIW94^;kRyPed0PgY$z*gomy488&URUL<gRZm5?
zqJlq=aE>4F`)ixkg~;-%200n!GmKJ9ar<>PJwL+&R?^(?i$394;xracp^uGvK#RQT
qPw<mu>$VE1PtJ;3ull9Vk;$LBEf!1@9Ou|SmXfZFLvjhQMRjgTppdWt

literal 2674
zcmV-&3XSyuM@dveQdv+`03Lg(Ea9kUZF0kWoqGjwZV11KxJUEE4%gx4MiQRnD>*@F
zBP1(6Ss--AX+Zq7&UG^A@QbPcQrFAeqK6Mp!nF1NLgMtnsxth>k|Qd7Pe--<6Q#jq
zxhPGZB(!U}?Vzwx)yXT_4~~H5HN1#@vd_*h1UoAau@OKSL=~m!lTEI$4ps2B?{Xm>
zxAEx>gh&pObUCn3t}&~65g`0X=Uy^YJ2b3kVjG*Ne+M3Eul%v#<eDtTyaAGS@tH2k
zh^|qQB@z;=315?Xkw~Kgom!P~eBrJoM<X#Xrh6@e;uzd#z2JNIqC){l`+RDMO8ATy
z<r=pzleifM@xIY}Y@M1E;PxJ;c7O~s;r<KdxJeZ#!%BpENh79!FPj@}V@8AC7(IX@
zXJ-e)&XTN<ry}&-6k)ch*PD{3hd>HF_Q;g16L-~p8T8+5GhABo2KjQnnH)6<XXjsP
zmrSM=GX^qA6usL#OtDW~DphgjwdR&vC%u*W%m5UUQuAT-`}hW-^SYejh9SZo0hWm5
zEK}482g^Gc&F6|!YCxl@3Jfn|Csx@c6fmr1`H8Y@jw8ZAI{UYzyFo)cu!6XMq=4QY
z8nG^!qy()_&QBsN$h%?ocFm)K?P%nlpA&u@Rks0X=Esbo)~>%2#D?f_CuxO$ZPrei
zkU$-A5PiDPDWl)L5_)crmgFl=-O=b7Y%<r_a&Ti%Px{D@mMg74Hn6)#irK5tAZ>&Q
zw$;}y_`?%e+jB8`n^%3@fW#*|W6XqB46z%yd-Xs?--FH&-^^{MBfE{A>nix(5;Mz$
zpn9Aqw=!Ohh6l3(=~AEe5ffQwC(#z{iM3GW`&8$Bs>++R|3n|<v|?coQ4l5ipy!cW
zC2n-|a9M%d`-3MzA$_6&rvI}yGPgvncQsutm0eg#U-jVkKPl<i+$(GEqD&j9R~UmV
z`HgSH`I{`%>en!9X=+#~7+yDD(n`Dswj}-<>7w$Bma6^*?fDLj6WzN_{OPDuFAj)L
zXk<JVOac50A|mJ94@;AIP1FaP_wP<rQvt1es&2=hVekdOO4dMwz=h;2dB*#2DgrBc
z;$}a&8Sl>ImC<DMUT{sfVk#qy|AL#Lw+EBPvPjH#{x3GaPo5NO2F>tK{<#p$W<Sz_
zF(9@Ii4MB5WOR%f|8KHxE)x>ZHhb+%_upQu>!}G!!l@?>Y~77s6bMBhJe*TFg46dv
za$r%#a_aU1L<rJzsZPJ-o%c7$rE?U|KCZTjGuu%l{NgVn2QKGkYyhrh&=}P_5pj<L
zW)<}K5}XS4c^?J*t{{4GL)&GY%^(<hicjqS7+b0+pwiO=D}ZPVpeF6D-Nm07<`5#4
z(C3MRV7%u^(11x;s094YB;B9grA<xVmo!23Q#1|XZ;)#9KD`(2e&@DTDJv%KM+-UI
z!wgq#qZrFG1a;QL857awN%3i{^pcU19(yIp$XhZA7_*rUT3wnh7Gg;dpAsaz=Dlg6
zAuH72mhRzL|JQh3ff>^U!VhK_a!`vsjENwD`7SCZjG#V31R{(FYcYeh`dT*%IPR0S
z&h_(Ci}Aa87>psvOeN~%v_B}!Y4)*gmSCN+ll1tzU(di9C5;#qjBN*4f-(9&gmpWM
z(gwN)(}OVT!8&~0iq-9(LUd1Nt*Xz!aW^AwZtiN#q%gY8s}#@l6f~8?jt;5g$*>x$
zcgt1cE`t~kIeq&kbgvrr{TEYWq3}3z<M@OSoOo@pM9pO6<d=mRB>zr{MC*G3d7o)h
zZm9)vg5F2Yx5@ljvl%iYuoGQ?d5W3EX+WX)8r3eui3&(T(u~Yr*cl1ESo5yPTw7!j
zUtW}-E%mt>mTY|K+t%M>1N1|-%2Yb)bvKzupJsjG^utVM0IOTz)E$TQ<lX*n9xivZ
zB=o!1BdLuaArC(}+eagju3I$5)a)CeNU8jIqVbr@ml9IIX|B}oi;X4bz2!5k(FtP0
z(?=#55njMV?0y3$Z5G>Ik{(ttjuIw_07dMzsXYJIv0z231CQi8nT%nyYxzjx@|Yy~
z078#W@M=6cbT1v?)u<N}FV>UB|Ca*C*tNW)r=Nrymjf&KZQ74XCK;I>0JO3g;|K+u
zkC&NA^OLOK(zz7k2Tt2b#4%eoB%~bR3e3&uawF^FN4d)3WB|nYHbN((X*SZMDZc*R
zuJ;A0e$__i^*yLKrFP*_PC;=@M#!l=%hq(}NB#HAFp;xblLqrLSZ>$h$T(sEOZp3)
z{|QHlMG=*4JL{lwM}afoRtc4kH%gl^>x;FFMa{}VkeXUzlE4xNpNy8A{%7sXdfeoz
z&RZU4T|l>_10=0DPd_zI#qUClYU5UJUmxU~)@NhPGKJyd7Dz<K@t`=x$JZ#_H7?A4
zArRh84u_i0+3_xk&*+mJ;yBOjCvGLLMof)U%xzRkBG531Er7UdJ%SOC7>IiWjU6TC
z_~$_W?ChsPgu&Afew2NG+aFSymqcIXpPFwx-^DE3t~Cw*kE5ZciP6wmT5^sb=5iVZ
z?r(iF!s<4t-t9N60_<%Pjjwp~t_Zaf&gAoLJTMWHipkA4BAl#-Bc2(%nEyaXotNGy
zm=Bq%gAc_uUn+V?**g`bMeGpt5Wxg<@mg{X-$27YUALveX=iB3LZ|0~V5G9PXJDnQ
z+w%Kg?$Ush=Gx<iWz&(xVx-SoV`fKzSjz~2*B1oZ`{1FvKS?((LG52_C+bmCJG81u
zD2!nrxPQYn0Lp<|wArb=iFX=0Qp9NrPd<EOYSx+CiUAPa?L6H5QW|M0CYk2fL;M7{
z@2WeN9zLMMoEf3*r>OMf&&QMZY{_oeoMqcSwpipGZ<O8+4SK?%slin?9InkvEaw|U
z8BdL>v=Gu`MdY|X9wgd1&vpu>@T?=okuKTKBJmu0nD$4;$t(5RfuU<;xy3=^hvV4K
zDgWo}zt1y;=tz-A{TJl;#<m1l|2M~^P_%R<DZ&o&fS`vD;G}o~>Y9i&k&p&m?=CV{
zvlNK{=s<~ksqQUHx0=a}@sCMB&42CRo7tEsbE*tX5V@RQ<cK8Iv#ra~%kToL$Ad5`
z)150mmSIW}E7lLM8&d1lz9T|n^(y;IMT$M5taa@fAg&scJ0?VN(=nHqS^(t=QBDo^
zZYjqWP`7g=f?6JEn)EzB7L+1?S?o8uhg9pH*nrNQFb4(p=1}-BYpX3^*f0d{Ermke
zUyaNC1>#$#IEBPG2?(4*Is5Nai7Gko&IQvZ7Yb5{O~TPI#Jh|$h1ET;wsw)L@grY)
zhIks!u7F<FiXw+%xn<v(uGIod>FNXPG;uc8xYxyOclfJFoG0MAOpHGM-yF!qN%7hs
zGDBsGZhR4tnckA4FOCX^w;-e&=h=7#9AaM0qa4rRlV&XgDhtd~O37BKE8juzL_XU-
z%u_=8X_(|h&LllFRxFZZqlSUjTrz7G6FPok<uZ<7-88!<2pze0WA^388O%cARGrfd
g=179#;}$}FTDjpyG@5%U26kih@_OX+09`ns)w?q_cK`qY

diff --git a/system/desktop/firewall.nix b/system/desktop/firewall.nix
index fd28138..11101a4 100644
--- a/system/desktop/firewall.nix
+++ b/system/desktop/firewall.nix
@@ -1,11 +1,13 @@
-{
+let
+  ips = import ../modules/ips.nix; 
+in {
   # Networking settings
   networking = {
     # Enable firewall
     firewall = {
       allowPing = false;
       extraInputRules = ''
-        ip saddr 10.0.0.2 accept comment "Accept Server Connections"
+        ip saddr { ${ips.server}, ${ips.wgSpan}.1 } accept comment "Accept Server"
       '';
     };
   };
diff --git a/system/desktop/wireguard.nix b/system/desktop/wireguard.nix
new file mode 100644
index 0000000..67d9809
--- /dev/null
+++ b/system/desktop/wireguard.nix
@@ -0,0 +1,23 @@
+{outputs, ...}: let
+  ips = import ../modules/ips.nix;
+in {
+  networking.firewall = {
+    allowedUDPPorts = [ 51820 ];
+  };
+
+  networking.wireguard.interfaces = {
+    "${ips.wgInt}" = {
+      # Define IP of client in per device config
+      listenPort = 51820;
+      privateKey = outputs.secrets.wgClientPriv;
+      peers = [
+        { # 0.0.0.0 makes wg act like a traditional VPN
+          publicKey = outputs.secrets.wgServerPub;
+          allowedIPs = [ "0.0.0.0/0" ];
+          endpoint = "mc.${outputs.secrets.jimDomain}:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+}
diff --git a/system/pinebook.nix b/system/pinebook.nix
index acd76f1..c321732 100644
--- a/system/pinebook.nix
+++ b/system/pinebook.nix
@@ -36,11 +36,14 @@
     ./services/mpd.nix
   ];
 
+  # Set hostname
+  networking.hostName = "JimPine";
+
   # Disable 32 bit graphics
   hardware.opengl.driSupport32Bit = lib.mkForce false;
 
-  # Set hostname
-  networking.hostName = "JimPine";
+  # Set the VPN IP per machine
+  networking.wireguard.interfaces."${ips.wgInt}".ips = [ "${ips.wgSpan}.17/24" ];
 
   # https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
   system.stateVersion = "24.05";
diff --git a/system/server/wireguard.nix b/system/server/wireguard.nix
index 9155f51..670490c 100644
--- a/system/server/wireguard.nix
+++ b/system/server/wireguard.nix
@@ -14,21 +14,23 @@ in {
   networking.wireguard = {
     enable = true;
     interfaces = {
-      # Wireguard interface name can be arbitrary
-      wg0 = {
-        # Determines the IP and subnet of the tunnel interface
+      "${ips.wgInt}" = {
         ips = [ "${ips.wgSpan}.1/24" ];
         listenPort = 51820;
-	privateKey = outputs.secrets.wireguardPriv;
+	privateKey = outputs.secrets.wgServerPriv;
         peers = [
           { # Jimbo Pixel 9
-            publicKey = outputs.secrets.wirePixel9Pub;
+            publicKey = outputs.secrets.wgPixel9Pub;
             allowedIPs = [ "${ips.wgSpan}.2/32" ];
           }
           { # Oracle VM
-            publicKey = outputs.secrets.wireOraclePub;
+            publicKey = outputs.secrets.wgOraclePub;
             allowedIPs = [ "${ips.wgSpan}.3/32" ];
           }
+          { # General Nix
+            publicKey = outputs.secrets.wgClientPub;
+            allowedIPs = [ "${ips.wgSpan}.16/28" ];
+          }
         ];
       };
     };