Update Wireguard client also

hosts/midas/default.nix

@@ -4,8 +4,8 @@
     ./boot
     ./disko
     ./filesystems
-    ./firewall
     ./hardware
+    ./network
     ./services
     ./users
     ../../modules/system

hosts/midas/firewall/default.nix

@@ -1,28 +0,0 @@
-{ ... }:
-{
-  networking.nftables.tables.forwarding = {
-    family = "inet";
-    content = ''
-      chain incoming {
-        type nat hook prerouting priority dstnat; policy accept;
-        tcp dport 2211 dnat ip to 11.0.0.100:22 comment "Tower SSH"
-        tcp dport 2222 dnat ip to 11.0.0.2:22 comment "Kitty SSH"
-        tcp dport 2233 dnat ip to 11.0.0.101:22 comment "Envy SSH"
-        tcp dport 2244 dnat ip to 11.0.0.102:22 comment "Intuos SSH"
-        
-        udp dport { 27005, 27015 } dnat ip to 11.0.0.100 comment "PC Hosted Games"
-        
-        tcp dport { 48010, 47989, 47984 } dnat ip to 11.0.0.100 comment "PC Sunshine TCP"
-        udp dport { 47998, 47999, 48000 } dnat ip to 11.0.0.100 comment "PC Sunshine UDP"
-      }
-
-      chain forward {
-        type nat hook postrouting priority 100; policy accept;
-        masquerade
-      }
-    '';
-  };
-
-  # Enable IP forwarding for the server configuration
-  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
-}

hosts/midas/network/default.nix

@@ -0,0 +1,38 @@
+{ ... }:
+{
+  networking = {
+    interfaces."eno1".ipv4.addresses = [{
+      address = "10.2.0.1";
+      prefixLength = 8;
+    }];
+    defaultGateway = {
+      address = "10.1.0.1";
+      interface = "eno1";
+    };
+    nftables.tables.forwarding = {
+      family = "inet";
+      content = ''
+        chain incoming {
+          type nat hook prerouting priority dstnat; policy accept;
+          tcp dport 2211 dnat ip to 11.0.0.100:22 comment "Tower SSH"
+          tcp dport 2222 dnat ip to 11.0.0.2:22 comment "Kitty SSH"
+          tcp dport 2233 dnat ip to 11.0.0.101:22 comment "Envy SSH"
+          tcp dport 2244 dnat ip to 11.0.0.102:22 comment "Intuos SSH"
+          
+          udp dport { 27005, 27015 } dnat ip to 11.0.0.100 comment "PC Hosted Games"
+          
+          tcp dport { 48010, 47989, 47984 } dnat ip to 11.0.0.100 comment "PC Sunshine TCP"
+          udp dport { 47998, 47999, 48000 } dnat ip to 11.0.0.100 comment "PC Sunshine UDP"
+        }
+
+        chain forward {
+          type nat hook postrouting priority 100; policy accept;
+          masquerade
+        }
+      '';
+    };
+  };
+
+  # Enable IP forwarding for the server configuration
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+}

hosts/midas/services/default.nix

@@ -17,7 +17,7 @@
     trilium-server.enable = true;
     vaultwarden.enable = true;
     webserver.enable = true;
-    wireguard.server.enable = true;
+    wg.server.enable = true;
 
     minecraft-servers = {
       enable = true;

hosts/tower/default.nix

@@ -4,23 +4,13 @@
     ./boot
     ./disko
     ./filesystems
-    ./firewall
     ./hardware
+    ./network
     ./users
     ../../modules/system
   ];
 
-  networking = {
+  networking.hostName = "tower";
-    hostName = "tower";
-    vlans.internal = {
-      id=100;
-      interface="enp42s0";
-    };
-    interfaces.internal.ipv4.addresses = [{
-      address = "11.0.0.100";
-      prefixLength = 8;
-    }];
-  };
 
   system = {
     desktop.enable = true;
@@ -28,5 +18,7 @@
     stateVersion = "24.05";
   };
 
+  services.wg.client.enable = true;
+
   virtualisation.libvirtd.enable = true;
 }

hosts/tower/firewall/default.nix

@@ -1,4 +0,0 @@
-{ ... }:
-{
-  networking.firewall.allowedUDPPorts = [ 27015 ];
-}

hosts/tower/network/default.nix

@@ -0,0 +1,15 @@
+{ ... }:
+{
+  networking.firewall.allowedUDPPorts = [ 27015 ];
+
+  systemd.network = {
+    netdevs."10-wg0".wireguardPeers = [
+      { # Local server                                         
+        PublicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8=";
+        AllowedIPs = [ "11.0.0.0/8" ];                        
+        Endpoint = "10.2.0.1:51820";                      
+      }
+    ];
+    networks."wg0".address = [ "11.0.0.100/8" ];
+  };
+}

modules/system/services/general/default.nix

@@ -12,5 +12,6 @@
     ./sunshine
     ./tlp
     ./userborn
+    ./wireguard
   ];
 }

modules/system/services/general/wireguard/default.nix

@@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+{
+  options.services.wg.client.enable = lib.mkEnableOption "Enable Wireguard client";
+
+  config = lib.mkIf config.services.wg.client.enable {
+    boot.kernelModules = [ "wireguard" ];
+
+    systemd.network = {
+      netdevs = {
+        "10-wg0" = {
+          netdevConfig = {
+            Kind = "wireguard";
+            Name = "wg0";
+            MTUBytes = "1300";
+          };
+          wireguardConfig = {
+            PrivateKeyFile = pkgs.writeText "wgclientsecret" config.secrets.wg.clientKey;
+            ListenPort = 9918;
+          };
+        };
+      };
+      networks."wg0" = {
+        matchConfig.Name = "wg0";
+        DHCP = "no";
+      };
+    };
+  };
+}

modules/system/services/server/wireguard/client/default.nix

@@ -1,14 +0,0 @@
-{ config, lib, ... }:
-{
-  networking.wg-quick.interfaces.wgc = lib.mkIf config.services.wireguard.client.enable {
-    privateKey = config.secrets.wg.clientKey;
-    peers = [
-      { # Home server
-        publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8=";
-        allowedIPs = [ "11.0.0.0/8" ];
-        endpoint = "sv.nixfox.ca:51820";
-        persistentKeepalive = 25;
-      }
-    ];
-  };
-}

modules/system/services/server/wireguard/default.nix

@@ -1,12 +1,44 @@
-{ lib, ... }:
+{ config, lib, pkgs, ... }:
 {
-  imports = [
+  options.services.wg.server.enable = lib.mkEnableOption "Enable Wireguard server";
-    ./client
-    ./server
-  ];
 
-  options.services.wireguard = with lib; {
+  config = lib.mkIf config.services.wg.server.enable {
-    client.enable = mkEnableOption "Enable Wireguard client";
+    systemd.network = {
-    server.enable = mkEnableOption "Enable Wireguard server";
+      netdevs = {
+        "50-wg0" = {
+          netdevConfig = {
+            Kind = "wireguard";
+            Name = "wg0";
+            MTUBytes = "1300";
+          };
+          wireguardConfig = {
+            PrivateKeyFile = pkgs.writeText "wgserversecret" config.secrets.wg.serverKey;
+            ListenPort = 51820;
+            RouteTable = "main";
+          };
+          wireguardPeers = [
+            { # NixOS Config Key
+              PublicKey = "OKUH/h6YSURI4vgeTZKQD15QsqaygdbTn1mAWzQp9S0=";
+              AllowedIPs = [ "11.0.0.0/8" ];
+            }
+            { # Pixel 9
+              PublicKey = "dPCtjm67adMZCnyL1O2L+uUOk0RbjA9T/tht1r+qcE4=";
+              AllowedIPs = [ "11.1.0.1/32" ];
+            }
+          ];
+        };
+      };
+      networks."wg0" = {
+        matchConfig.Name = "wg0";
+        address = [ "11.0.0.1/8" ];
+        networkConfig = {
+          IPMasquerade = "both";
+          IPv4Forwarding = true;
+          IPv6Forwarding = true;
+        };
+      };
+    };
+
+    networking.firewall.allowedUDPPorts = [ 51820 ];
   };
 }

modules/system/services/server/wireguard/server/default.nix

@@ -1,42 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  config = lib.mkIf config.services.wireguard.server.enable {
-    systemd.network = {
-      netdevs = {
-        "50-wg0" = {
-          netdevConfig = {
-            Kind = "wireguard";
-            Name = "wg0";
-            MTUBytes = "1300";
-          };
-          wireguardConfig = {
-            PrivateKeyFile = pkgs.writeText "wgserversecret" config.secrets.wg.serverKey;
-            ListenPort = 51820;
-            RouteTable = "main";
-          };
-          wireguardPeers = [
-            { # NixOS Config Key
-              PublicKey = "OKUH/h6YSURI4vgeTZKQD15QsqaygdbTn1mAWzQp9S0=";
-              AllowedIPs = [ "11.0.0.0/8" ];
-            }
-            { # Pixel 9
-              PublicKey = "dPCtjm67adMZCnyL1O2L+uUOk0RbjA9T/tht1r+qcE4=";
-              AllowedIPs = [ "11.1.0.1/32" ];
-            }
-          ];
-        };
-      };
-      networks.wg0 = {
-        matchConfig.Name = "wg0";
-        address = [ "11.0.0.1/8" ];
-        networkConfig = {
-          IPMasquerade = "both";
-          IPv4Forwarding = true;
-          IPv6Forwarding = true;
-        };
-      };
-    };
-
-    networking.firewall.allowedUDPPorts = [ 51820 ];
-  };
-}