What a clusterfuck

modules/system/devices/networking/wireguard/client/default.nix

@@ -0,0 +1,22 @@
+{ outputs, ... }:
+{
+  networking.firewall = {
+    allowedUDPPorts = [ 51820 ];
+  };
+
+  networking.wireguard.interfaces = {
+    "${outputs.ips.wgInt}" = {
+      # Define IP of client in per device config
+      listenPort = 51820;
+      privateKey = outputs.secrets.wgClientPriv;
+      peers = [
+        { # 0.0.0.0 makes wg act like a traditional VPN
+          publicKey = outputs.secrets.wgServerPub;
+          allowedIPs = [ "0.0.0.0/0" ];
+          endpoint = "sv.${outputs.secrets.jimDomain}:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+}

modules/system/devices/networking/wireguard/host/default.nix

@@ -0,0 +1,36 @@
+{ outputs, ... }:
+{
+  networking = {
+    nat = {
+      enable = true;
+      externalInterface = "${outputs.ips.netInt}";
+      internalInterfaces = [ "${outputs.ips.wgInt}" ];
+    };
+    firewall.allowedUDPPorts = [ 51820 ];
+  };
+
+  networking.wireguard = {
+    enable = true;
+    interfaces = {
+      "${outputs.ips.wgInt}" = {
+        ips = [ "${outputs.ips.wgSpan}.1/24" ];
+        listenPort = 51820;
+        privateKey = outputs.secrets.wgServerPriv;
+        peers = [
+          { # Jimbo Pixel 9
+            publicKey = outputs.secrets.wgPixel9Pub;
+            allowedIPs = [ "${outputs.ips.wgSpan}.2/32" ];
+          }
+          { # Oracle VM
+            publicKey = outputs.secrets.wgOraclePub;
+            allowedIPs = [ "${outputs.ips.wgSpan}.3/32" ];
+          }
+          { # General Nix
+            publicKey = outputs.secrets.wgClientPub;
+            allowedIPs = [ "${outputs.ips.wgSpan}.16/28" ];
+          }
+        ];
+      };
+    };
+  };
+}