feat(heimdall+desktop): setup wireguard tunnel.

modules/linux/nixos/default.nix

@@ -23,6 +23,7 @@
     ./sunshine.nix
     ./nh.nix
     ./ollama.nix
+    ./secrets.nix
   ];
 
   crony.bluetooth.enable = lib.mkDefault true;

modules/linux/nixos/secrets.nix

@@ -0,0 +1,10 @@
+{
+  age = {
+    secrets = {
+      wg-desktop = {
+        file = ../../../secrets/wg-desktop.age;
+      };
+    };
+    identityPaths = ["/home/crony/.ssh/main"];
+  };
+}

modules/linux/nixos/wireguard.nix

@@ -8,19 +8,10 @@
   };
 
   config = lib.mkIf config.crony.wireguard.enable {
-    # Allow for wireguard traffic
-    networking.firewall = {
-      # if packets are still dropped, they will show up in dmesg
-      logReversePathDrops = true;
-      # wireguard trips rpfilter up
-      extraCommands = ''
-        ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN
-        ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN
-      '';
-      extraStopCommands = ''
-        ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true
-        ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true
-      '';
+    # Setup wireguard
+    networking.wg-quick.interfaces.wg0 = {
+      autostart = false;
+      configFile = "${config.age.secrets.wg-desktop.path}";
     };
   };
 }