nixos-config/hosts/burnham/services/wireguard.nix

{ config, pkgs, lib, ... }:
let
  cfg = config.networking.wireguard.interfaces."wg0";
in {
  networking = {
    nat = {
      enable = true;
      externalInterface = "ens18";
      internalInterfaces = [ "wg0" ];
    };
    firewall.allowedUDPPorts = [ cfg.listenPort ];

    wireguard.interfaces."wg0" = {
      ips = [ "10.100.0.2/24" ];
      listenPort = 51820;
      privateKeyFile = "/etc/wireguard/burnham.private";

      postSetup = ''
        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -d 192.168.11.0/24 -o eth0 -j MASQUERADE
      '';
      postShutdown = ''
        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -d 192.168.11.0/24 -o eth0 -j MASQUERADE
      '';

      peers = [
        { # Defiant
          publicKey = "8/711GhmN9+NcduHF4JPkfoZPE0qsDLuwhABcPyjNxI=";
          persistentKeepalive = 120;
          allowedIPs = [
            "10.100.0.1/32"
            "192.168.10.0/24"
          ];
          endpoint = "site3.feal.no:51902";
        }
        { # Worf
          publicKey = "kW8SyzCh2tw8GzZV6bPn+IQVNUoUhseNfEm3rHnR1So=";
          allowedIPs = [
            "10.100.0.4/32"
          ];
        }
        { # Phone
          publicKey = "axFXtcTYtW6m1FT9Czn9DRvG+b05D7j+0yRMjn/FJEk=";
          allowedIPs = [
            "10.100.0.5/32"
          ];
        }
        { # Riker
          publicKey = "r715vpgH1H0zvN+Z5wcNKcOo5e6UM3fBfh9BZwTBjmA=";
          allowedIPs = [
            "10.100.0.6/32"
          ];
        }
      ];
    };
  };
}