From 988005d5d57768a9cf934697e9dd8fd417c66db7 Mon Sep 17 00:00:00 2001
From: Franck Cuny <franck@fcuny.net>
Date: Fri, 28 Nov 2025 13:10:56 -0800
Subject: add a profile for wireguard configuration

---
 machines/nixos/x86_64-linux/rivendell.nix | 39 +------------------------------
 1 file changed, 1 insertion(+), 38 deletions(-)

(limited to 'machines/nixos/x86_64-linux/rivendell.nix')

diff --git a/machines/nixos/x86_64-linux/rivendell.nix b/machines/nixos/x86_64-linux/rivendell.nix
index bd7d01b..3d64722 100644
--- a/machines/nixos/x86_64-linux/rivendell.nix
+++ b/machines/nixos/x86_64-linux/rivendell.nix
@@ -17,18 +17,9 @@
     ../../../profiles/remote-unlock.nix
     ../../../profiles/restic-backup.nix
     ../../../profiles/server.nix
+    ../../../profiles/wireguard.nix
   ];
 
-  age = {
-    secrets = {
-      wireguard = {
-        file = ../../../secrets/rivendell/wireguard.age;
-      };
-    };
-  };
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-
   networking.hostName = "rivendell";
   networking.useDHCP = lib.mkDefault true;
   systemd.network.wait-online.anyInterface = lib.mkDefault config.networking.useDHCP;
@@ -46,34 +37,6 @@
 
   nix.settings.trusted-users = [ "builder" ];
 
-  networking.wireguard = {
-    enable = true;
-    interfaces.wg0 = {
-      ips = [ "10.100.0.60/32" ];
-      listenPort = 51871;
-      privateKeyFile = config.age.secrets.wireguard.path;
-      peers = [
-        {
-          # bree
-          publicKey = "bJZyQoemudGJQox8Iegebm23c4BNVIxRPy1kmI2l904=";
-          allowedIPs = [ "10.100.0.40/32" ];
-          persistentKeepalive = 25;
-          endpoint = "192.168.1.50:51871";
-        }
-        {
-          # argonath
-          publicKey = "vTItDh9YPnA+8hL1kIK+7EHv0ol3qvhfAfz790miw1w=";
-          allowedIPs = [ "10.100.0.51/32" ];
-          endpoint = "157.230.146.234:51871";
-          persistentKeepalive = 25;
-        }
-      ];
-    };
-  };
-
-  networking.firewall.trustedInterfaces = [ "wg0" ];
-  networking.firewall.allowedUDPPorts = [ 51871 ];
-
   services.website = {
     enable = true;
     openFirewall = true;
-- 
cgit v1.2.3