3 files changed, 5 insertions, 108 deletions
diff --git a/machines/nixos/x86_64-linux/argonath.nix b/machines/nixos/x86_64-linux/argonath.nix
index 218df5a..4b72ca9 100644
--- a/machines/nixos/x86_64-linux/argonath.nix
+++ b/machines/nixos/x86_64-linux/argonath.nix
@@ -1,9 +1,4 @@
-{
-  config,
-  lib,
-  adminUser,
-  ...
-}:
+{ adminUser, ... }:
 {
   imports = [
     ../../../profiles/acme.nix
@@ -14,40 +9,10 @@
     ../../../profiles/home-manager.nix
     ../../../profiles/reverse-proxy.nix
     ../../../profiles/server.nix
+    ../../../profiles/wireguard.nix
   ];
 
-  age.secrets.wireguard.file = ../../../secrets/argonath/wireguard.age;
-
-  # fixes duplicated devices in mirroredBoots
-  boot.loader.grub.devices = lib.mkForce [ "/dev/vda" ];
-
-  disko.devices.disk.disk1.device = "/dev/vda";
-
-  networking.wireguard = {
-    enable = true;
-    interfaces.wg0 = {
-      ips = [ "10.100.0.51/32" ];
-      listenPort = 51871;
-      privateKeyFile = config.age.secrets.wireguard.path;
-      peers = [
-        {
-          # bree
-          publicKey = "bJZyQoemudGJQox8Iegebm23c4BNVIxRPy1kmI2l904=";
-          allowedIPs = [ "10.100.0.40/32" ];
-          persistentKeepalive = 25;
-        }
-        {
-          # rivendell
-          publicKey = "jf7T7TMKQWSgSXhUplldZDV9G2y2BjMmHIAhg5d26ng=";
-          allowedIPs = [ "10.100.0.60/32" ];
-          persistentKeepalive = 25;
-        }
-      ];
-    };
-  };
-
-  networking.firewall.trustedInterfaces = [ "wg0" ];
-  networking.firewall.allowedUDPPorts = [ 51871 ];
+  networking.hostName = "argonath";
 
   system.stateVersion = "25.05"; # Did you read the comment?
 
diff --git a/machines/nixos/x86_64-linux/bree.nix b/machines/nixos/x86_64-linux/bree.nix
index 7296077..2f564b5 100644
--- a/machines/nixos/x86_64-linux/bree.nix
+++ b/machines/nixos/x86_64-linux/bree.nix
@@ -12,44 +12,13 @@
     ../../../profiles/hardware/synology-vm.nix
     ../../../profiles/home-manager.nix
     ../../../profiles/server.nix
+    ../../../profiles/wireguard.nix
   ];
 
-  age.secrets.wireguard.file = ../../../secrets/bree/wireguard.age;
-
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.systemd-boot.enable = true;
-
   networking.hostName = "bree";
   networking.useDHCP = lib.mkDefault true;
   systemd.network.wait-online.anyInterface = lib.mkDefault config.networking.useDHCP;
 
-  networking.wireguard = {
-    enable = true;
-    interfaces.wg0 = {
-      ips = [ "10.100.0.40/32" ];
-      listenPort = 51871;
-      privateKeyFile = config.age.secrets.wireguard.path;
-      peers = [
-        {
-          # argonath
-          publicKey = "vTItDh9YPnA+8hL1kIK+7EHv0ol3qvhfAfz790miw1w=";
-          allowedIPs = [ "10.100.0.51/32" ];
-          endpoint = "157.230.146.234:51871";
-          persistentKeepalive = 25;
-        }
-        {
-          # rivendell
-          publicKey = "jf7T7TMKQWSgSXhUplldZDV9G2y2BjMmHIAhg5d26ng=";
-          allowedIPs = [ "10.100.0.60/32" ];
-          persistentKeepalive = 25;
-        }
-      ];
-    };
-  };
-
-  networking.firewall.trustedInterfaces = [ "wg0" ];
-  networking.firewall.allowedUDPPorts = [ 51871 ];
-
   home-manager = {
     users.${adminUser.name} = {
       imports = [
diff --git a/machines/nixos/x86_64-linux/rivendell.nix b/machines/nixos/x86_64-linux/rivendell.nix
index bd7d01b..3d64722 100644
--- a/machines/nixos/x86_64-linux/rivendell.nix
+++ b/machines/nixos/x86_64-linux/rivendell.nix
@@ -17,18 +17,9 @@
     ../../../profiles/remote-unlock.nix
     ../../../profiles/restic-backup.nix
     ../../../profiles/server.nix
+    ../../../profiles/wireguard.nix
   ];
 
-  age = {
-    secrets = {
-      wireguard = {
-        file = ../../../secrets/rivendell/wireguard.age;
-      };
-    };
-  };
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-
   networking.hostName = "rivendell";
   networking.useDHCP = lib.mkDefault true;
   systemd.network.wait-online.anyInterface = lib.mkDefault config.networking.useDHCP;
@@ -46,34 +37,6 @@
 
   nix.settings.trusted-users = [ "builder" ];
 
-  networking.wireguard = {
-    enable = true;
-    interfaces.wg0 = {
-      ips = [ "10.100.0.60/32" ];
-      listenPort = 51871;
-      privateKeyFile = config.age.secrets.wireguard.path;
-      peers = [
-        {
-          # bree
-          publicKey = "bJZyQoemudGJQox8Iegebm23c4BNVIxRPy1kmI2l904=";
-          allowedIPs = [ "10.100.0.40/32" ];
-          persistentKeepalive = 25;
-          endpoint = "192.168.1.50:51871";
-        }
-        {
-          # argonath
-          publicKey = "vTItDh9YPnA+8hL1kIK+7EHv0ol3qvhfAfz790miw1w=";
-          allowedIPs = [ "10.100.0.51/32" ];
-          endpoint = "157.230.146.234:51871";
-          persistentKeepalive = 25;
-        }
-      ];
-    };
-  };
-
-  networking.firewall.trustedInterfaces = [ "wg0" ];
-  networking.firewall.allowedUDPPorts = [ 51871 ];
-
   services.website = {
     enable = true;
     openFirewall = true;