{ config, lib, pkgs, ... }: with lib; let cfg = config.services.wg-clerie; in { options = { services.wg-clerie = { enable = mkEnableOption "VPN for public static IP"; privateKeyFile = mkOption { type = types.str; default = "/var/src/secrets/wireguard/wg-clerie"; description = "Path to file containing private key for wireguard interface"; }; ipv6s = mkOption { type = with types; listOf str; default = []; description = "IPv6 interface addresses"; }; ipv4s = mkOption { type = with types; listOf str; default = []; description = "IPv4 interface addresses"; }; }; }; config = mkIf cfg.enable { networking.iproute2.enable = true; networking.iproute2.rttablesExtraConfig = '' 200 wg-clerie ''; petabyte.policyrouting = { enable = true; rules6 = concatMap (ip: [ { rule = "from ${ip} lookup wg-clerie"; prio = 20000; } { rule = "from ${ip} unreachable"; prio = 20001; } ]) cfg.ipv6s; rules4 = concatMap (ip: [ { rule = "from ${ip} lookup wg-clerie"; prio = 20000; } { rule = "from ${ip} unreachable"; prio = 20001; } ]) cfg.ipv4s; }; networking.wireguard.enable = true; networking.wireguard.interfaces = { wg-clerie = { inherit (cfg) privateKeyFile; ips = cfg.ipv6s ++ cfg.ipv4s; table = "wg-clerie"; peers = [ { endpoint = "vpn.clerie.de:51820"; persistentKeepalive = 25; dynamicEndpointRefreshSeconds = 5; allowedIPs = [ "0.0.0.0/0" "::/0" "10.20.30.0/24" "2a01:4f8:c0c:15f1::/113" ]; publicKey = "2p1Jqs3bkXbXHFWE6vp1yxHIFoUaZQEARS2nJzbkuBA="; } ]; }; }; }; }