wireguard: use agenix from the module

This is the correct way to set up the private key, let's see if this
works consistently across hosts and reboots.

1 files changed, 8 insertions, 2 deletions

diff --git a/lib/private-wireguard.nix b/lib/private-wireguard.nix
index 0d9b904..25f30b4 100644
--- a/lib/private-wireguard.nix
+++ b/lib/private-wireguard.nix
@@ -5,7 +5,7 @@ let
   inherit (builtins) readFile fromTOML fromJSON;
 
   cfg = config.networking.private-wireguard;
-  port = 51871;
+  port = 51820;
   wgcfg = fromTOML (readFile ./../configs/wireguard.toml);
   allPeers = wgcfg.peers;
   thisPeer = allPeers."${hostname}" or null;
@@ -16,10 +16,16 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
+    age.secrets.wg-privkey = {
+      file = ../secrets/network/${config.networking.hostName}/wireguard_privatekey.age;
+      mode = "0440";
+      owner = "0";
+    };
+
     networking = {
       wireguard.interfaces.wg0 = {
         listenPort = port;
-        privateKeyFile = "/var/lib/wireguard/wg0.key";
+        privateKeyFile = "/run/agenix/wg-privkey";
         ips = [
           "${wgcfg.subnet4}.${toString thisPeer.ipv4}/${toString wgcfg.mask4}"
         ];