WIP: router: wireguard: finalize wg0 config for now

hosts/common-desktop.nix

@@ -114,6 +114,7 @@
     ripgrep-all
     rustscan
     whois
+    wireguard-tools
     yt-dlp
   ] ++ [
     bitwarden-desktop

hosts/router/default.nix

@@ -78,6 +78,7 @@ in
     transcrypt
     waypipe
     whois
+    wireguard-tools
   ];
 
   # This value determines the NixOS release from which the default

hosts/router/firewall.nix

@@ -87,7 +87,7 @@ in
     content = ''
       ${nftIdentifiers}
       define ALLOWED_TCP_PORTS = { ssh }
-      define ALLOWED_UDP_PORTS = { 18596 }
+      define ALLOWED_UDP_PORTS = { ${toString vars.ifs.wg0.listenPort} }
       define ALLOWED_TCP_LAN_PORTS = { ssh, https }
       define ALLOWED_UDP_LAN_PORTS = { bootps, dhcpv6-server, domain, https }
       set port_forward_v6 {

hosts/router/ifconfig.nix

@@ -83,7 +83,7 @@ in
       ia_pd 30/${ifs.lan30.net6} -
       ia_pd 40/${ifs.lan40.net6} -
       ia_pd 50/${ifs.lan50.net6} -
-      ia_pd 100/${pdFromWan}8::/64 -  # for vpn stuff
+      ia_pd 100/${pdFromWan}9::/64 -  # for vpn stuff
       # ia_pd 8 -
 
       # the leases can be assigned to the interfaces,

hosts/router/secrets/wireguard/wg0-peer-AsusS513-psk.age

@@ -1,5 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 D2MY/A YAk0egMScFdPo0uAZzITtgQyPAifDcVUfb957Zhz9Ec
-pAEM+7sbPE8rHBhRV7mTmH1w4mbfKFopMWbwu/3KHCw
---- ykshsqEqKvCCE2kWIPAJPA/DFW7mu6+0x4MQhHgi1yU
-'ÈzÆ€{gÈid\{çEâ•Ätp¢U×g2QC3gßÈJGªV1Ð6·WG_E&»vŽó)°&òüñÞ‘N"§ƒ¯n©_TÍ’¸

hosts/router/secrets/wireguard/wg0-peer-Yura-TPX13-psk.age

@@ -1,6 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 D2MY/A P88M0uj4ZphVo3WrRYDu+c7B0Dl7ncctbYkByYmU2wg
-DV3Gn6TQ6iByAlNt0gg8kSZ2r0Gie/wcznZx9M+CC2g
---- KhwGM50BVql02Jq0do2uhXMfgWPPDfbodzDRmZ9n0O4
-r<EFBFBD>¸›Ô¶aõyY/C¡£JæB®Xº!ñ"F
-¿h‹­Ò(ñL>Œ()Üó»û<C2BB>òS;·}}2ОO.¯óhoqYðK"cˆEÛÕJM?-ËO
+-> ssh-ed25519 D2MY/A cRVo1AetNYKsb28kGpe6mVpoCyfNcRibeBYhJuXbbEY
+k8XL4XEv4FM6sfU/TOFTg4vlKm61409No/TpCEjTnSk
+--- mT9w1vnx2FrzWw+Zt1wV6UJ+mjHTizrUPVeaTisYQ74
+=—q-SoÁÚpn„”§ÆöIÿ•þZÖ i˜'ƒÖÓ"%M©®¯C&

hosts/router/secrets/wireguard/wg0-private-key.age

@@ -1,5 +1,5 @@
 age-encryption.org/v1
--> ssh-ed25519 D2MY/A tvRtTGWnaB0zxqZRba4/XpzwPa61RrnHCk4tT8OfnGQ
-IX85Q5VKxQTl+MnhzwiuTnNMVkR9QrYo/1njrbZeBnQ
---- dmlPIL2T+RFhbO2iLDRa4BxxYSSUQdedV3TK83ooFdA
-萭E	7搸0`d鑆(o赪饱籗@
傐瓩渿p瓥樼豘羳袃T砬枉禪堺+*齖Q嵗[龘巷xё29瞚5錵
+-> ssh-ed25519 D2MY/A Xg7XTl/qJqVqvXsHNKcoICq74DeOlquN1CEn1PwxlVY
+FqmPdDgmuUrwZPLW56RhW8o1VXr5l2Xms6IVebpi7bA
+--- nLT/bC55EvoXK6f7DYbMhD3I8Z122bxeGVw1PCds2IM
+!×ûãDlµêôñ°Ý;ÉûKXq8ï4”œ©‰+b‚·p_q4Bý³'8–%þcI„„D±tÓ<0C>ƒV~;v*ÆúW·-¹,[´tÝ‘ì

hosts/router/vars.nix

@@ -104,10 +104,12 @@ rec {
       name_ = "wg0";
       domain_ = "wg0.${ldomain}";
       p4_ = "10.18.16";  # .0/24
-      p6_ = "${pdFromWan}8:0:6";  # ::/96
+      p6_ = "${pdFromWan}9:0:6";  # ::/96
       p6Size_ = 96;
       ulaPrefix_ = "${ulaPrefix}:0100:0:6";  # ::/96
       ulaSize_ = 96;
+    } // {
+      listenPort = 51944;
     };
   };
 

hosts/router/wireguard.nix

@@ -9,28 +9,15 @@ let
     "${ifObj.ulaPrefix}:${toString token}:0/112"
   ];
 
-  mkWg0Peer = token: publickey: {
+  mkWg0Peer = token: publicKey: {
     allowedIPs = peerIps wg0 token;
-    inherit publickey;
+    inherit publicKey;
     pskEnabled = true;
   };
 
   wg0Peers = {
-    "Yura-TPX13" = {
-      allowedIPs = peerIps wg0 3;
-      publicKey = "iJa5JmJbMHNlbEluNwoB2Q8LyrPAfb7S/mluanMcI08=";
-      pskEnabled = true;
-    };
-    "Yura-Pixel7Pro" = {
-      allowedIPs = [ "${wg0.p4}.4/32" "${wg0.p6}:4:0/112" ];
-      publicKey = "UjZlsukmAsX60Z5FnZwKCSu141Gjj74+hBVT3TRhwT4=";
-      pskEnabled = true;
-    };
-    "AsusS513" = {
-      allowedIPs = [ "${wg0.p4}.100/32" ];
-      publicKey = "XozJ7dHdJfkLORkCVxaB1VmvHEOAA285kRZcmzfPl38=";
-      pskEnabled = false;
-    };
+    "Yura-TPX13" = mkWg0Peer 100 "iFdsPYrpw7vsFYYJB4SOTa+wxxGVcmYp9CPxe0P9ewA=";
+    "Yura-Pixel7Pro" = mkWg0Peer 101 "GPdXxjvnhsyufd2QX/qsR02dinUtPnnxrE66oGt/KyA=";
   };
   peerSecretName = name: "wg0-peer-${name}-psk";
   secrets = config.secrix.services.systemd-networkd.secrets;
@@ -43,20 +30,26 @@ in
       value.encrypted.file = ./secrets/wireguard/${peerSecretName name}.age;
     };
     peerSecrets = lib.attrsets.mapAttrs' mapPeer pskPeers;
-  in
-  {
+
+    allSecrets = {
       wg0-private-key.encrypted.file = ./secrets/wireguard/wg0-private-key.age;
     } // peerSecrets;
 
+    setSecretOwnership = name: value: value // {
+      decrypted.user = "systemd-network";
+      decrypted.group = "systemd-network";
+    };
+  in lib.attrsets.mapAttrs setSecretOwnership allSecrets;
+
   systemd.network.netdevs = {
     "10-wg0" = {
       netdevConfig = {
         Kind = "wireguard";
-        Name = "wg0";
+        Name = wg0.name;
       };
       wireguardConfig = {
         PrivateKeyFile = secrets.wg0-private-key.decrypted.path;
-        ListenPort = 18596;
+        ListenPort = wg0.listenPort;
       };
       wireguardPeers = map (peer: {
         AllowedIPs = lib.strings.concatStringsSep "," peer.value.allowedIPs;