path: root/machines/nixos/x86_64-linux/do-rproxy/default.nix

{ config, modulesPath, ... }:
{

  imports = [
    (modulesPath + "/virtualisation/digital-ocean-config.nix")
    ./disks.nix
    ./secrets.nix
    ./profiles/nginx.nix
  ];

  networking.hostName = "do-rproxy";

  networking.wireguard = {
    enable = true;
    interfaces.wg0 = {
      ips = [ "10.100.0.50/32" ];
      listenPort = 51871;
      privateKeyFile = config.age.secrets.wireguard.path;
      peers = [
        {
          # vm-synology
          publicKey = "bJZyQoemudGJQox8Iegebm23c4BNVIxRPy1kmI2l904=";
          allowedIPs = [ "10.100.0.40/32" ];
          persistentKeepalive = 25;
        }
        {
          # rivendell
          publicKey = "jf7T7TMKQWSgSXhUplldZDV9G2y2BjMmHIAhg5d26ng=";
          allowedIPs = [ "10.100.0.60/32" ];
          persistentKeepalive = 25;
        }
      ];
    };
  };

  networking.firewall.trustedInterfaces = [ "wg0" ];
  networking.firewall.allowedUDPPorts = [ 51871 ];

  my.modules.hardware.do-droplet.enable = true;

  system.stateVersion = "25.05"; # Did you read the comment?
}