Maybe unfinished support for wireguard Nix clients

system/desktop/firewall.nix

@@ -1,11 +1,13 @@
-{
+let
+  ips = import ../modules/ips.nix; 
+in {
   # Networking settings
   networking = {
     # Enable firewall
     firewall = {
       allowPing = false;
       extraInputRules = ''
-        ip saddr 10.0.0.2 accept comment "Accept Server Connections"
+        ip saddr { ${ips.server}, ${ips.wgSpan}.1 } accept comment "Accept Server"
       '';
     };
   };

system/desktop/wireguard.nix

@@ -0,0 +1,23 @@
+{outputs, ...}: let
+  ips = import ../modules/ips.nix;
+in {
+  networking.firewall = {
+    allowedUDPPorts = [ 51820 ];
+  };
+
+  networking.wireguard.interfaces = {
+    "${ips.wgInt}" = {
+      # Define IP of client in per device config
+      listenPort = 51820;
+      privateKey = outputs.secrets.wgClientPriv;
+      peers = [
+        { # 0.0.0.0 makes wg act like a traditional VPN
+          publicKey = outputs.secrets.wgServerPub;
+          allowedIPs = [ "0.0.0.0/0" ];
+          endpoint = "mc.${outputs.secrets.jimDomain}:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+}