feat(heimdall+desktop): setup wireguard tunnel.

modules/servers/heimdall/default.nix

@@ -2,5 +2,7 @@
   imports = [
     ./uptime-kuma.nix
     ./ntfy-sh.nix
+    ./wireguard.nix
+    ./secrets.nix
   ];
 }

modules/servers/heimdall/secrets.nix

@@ -0,0 +1,9 @@
+{
+  age = {
+    secrets = {
+      wg-heimdall = {
+        file = ../../../secrets/wg-heimdall.age;
+      };
+    };
+  };
+}

modules/servers/heimdall/wireguard.nix

@@ -0,0 +1,24 @@
+{config, ...}: {
+  networking = {
+    nat = {
+      enable = true;
+      enableIPv6 = true;
+      externalInterface = "enp1s0";
+      internalInterfaces = ["wg0"];
+    };
+    firewall = {
+      allowedTCPPorts = [53];
+      allowedUDPPorts = [53 51820];
+    };
+    wg-quick.interfaces.wg0.configFile = "${config.age.secrets.wg-heimdall.path}";
+  };
+
+  services.dnsmasq = {
+    enable = true;
+    settings = {
+      interface = "wg0";
+    };
+  };
+
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+}