BIG changes. Make almost every server service modular, to distribute among multiple servers

modules/system/services/server/wireguard/client/default.nix

@@ -0,0 +1,19 @@
+{ config, lib, ... }:
+{
+  config = lib.mkIf config.services.wireguard.client.enable {
+    networking = {
+      firewall.trustedInterfaces = [ "wgc" ];
+      wg-quick.interfaces.wgc = {
+        privateKey = config.secrets.wg.clientKey;
+        peers = [
+          { # Kitty server
+            publicKey = "qnOT/lXOJMaQgDUdXpyfGZB2IEyUouRje2m/bCe9ux8=";
+            allowedIPs = [ "10.100.0.0/24" ];
+            endpoint = "sv.nixfox.ca:51820";
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+    };
+  };
+}

modules/system/services/server/wireguard/default.nix

@@ -0,0 +1,12 @@
+{ lib, ... }:
+{
+  imports = [
+    ./client
+    ./server
+  ];
+
+  options.services.wireguard = with lib; {
+    client.enable = mkEnableOption "Enable Wireguard client";
+    server.enable = mkEnableOption "Enable Wireguard server";
+  };
+}

modules/system/services/server/wireguard/server/default.nix

@@ -0,0 +1,29 @@
+{ config, lib, ... }:
+{
+  config = lib.mkIf config.services.wireguard.server.enable {
+    networking = {
+      firewall.allowedUDPPorts = [ 51820 ];
+
+      nat = {
+        enable = true;
+        internalInterfaces = [ "wgs" ];
+      };
+
+      wireguard.interfaces.wgs = {
+        ips = [ "10.100.0.1/24" ];
+        listenPort = 51820;
+        privateKey = config.secrets.wg.serverKey;
+        peers = [
+          { # NixOS Config Key
+            publicKey = "OKUH/h6YSURI4vgeTZKQD15QsqaygdbTn1mAWzQp9S0=";
+            allowedIPs = [ "10.100.0.16/28" ];
+          }
+          { # Pixel 9
+            publicKey = "dPCtjm67adMZCnyL1O2L+uUOk0RbjA9T/tht1r+qcE4=";
+            allowedIPs = [ "10.100.0.2/32" ];
+          }
+        ];
+      };
+    };
+  };
+}