organized, fixed wireguard config

modules/agenix.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }:
+
+let
+  agenixSrc = builtins.fetchTarball "https://github.com/ryantm/agenix/archive/main.tar.gz";
+in {
+  imports = [
+    "${agenixSrc}/modules/age.nix"
+  ];
+
+  environment.systemPackages = [
+    (pkgs.callPackage "${agenixSrc}/pkgs/agenix.nix" { })
+  ];
+}

modules/users/may.nix

@@ -12,18 +12,5 @@
       username = "may";
       homeDirectory = "/home/may";
     };
-
-    home.packages = with pkgs; [
-      firefox
-      chromium
-      vlc
-      spotify
-      vscode
-      jetbrains.idea
-      obs-studio
-      gh
-      jetbrains.rust-rover
-      wayvnc
-    ];
   };
 }

modules/wireguard-server.nix

@@ -0,0 +1,56 @@
+{ config, pkgs, ... }:
+let
+  wg-key-pub-home = builtins.readFile ../secrets/wireguard/home_pub;
+in
+{
+  age.secrets.wg-server-priv.file = ../secrets/wireguard/server_priv.age;
+  age.secrets.wg-home-psk.file = ../secrets/wireguard/home_psk.age;
+
+  networking.wireguard.enable = true;
+
+  # enable NAT
+  networking.nat = {
+    enable = true;
+    enableIPv6 = false;
+    externalInterface = "eno1";
+    internalInterfaces = [ "wg0" ];
+  };
+
+  networking.wireguard.interfaces.wg0 = {
+    ips = [ "10.6.0.1/24" ];
+    listenPort = 51820;
+
+    privateKeyFile = config.age.secrets.wg-server-priv.path;
+
+
+    # This allows the wireguard server to route your traffic to the internet and hence be like a VPN
+    # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
+    postSetup = ''
+      ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.6.0.0/24 -o eno1 -j MASQUERADE
+    '';
+
+    # This undoes the above command
+    postShutdown = ''
+      ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.6.0.0/24 -o eno1 -j MASQUERADE
+    '';
+
+    peers = [
+      {
+        name = "Home";
+        publicKey = wg-key-pub-home;
+        presharedKeyFile = config.age.secrets.wg-home-psk.path;
+        allowedIPs = [ "10.6.0.2/32" ];
+      }
+    ];
+  };
+
+  networking.firewall = {
+    allowedUDPPorts = [ 51820 ];
+  };
+
+  # Enable forwarding
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+    "net.ipv6.conf.all.forwarding" = 1;
+  };
+}