Add wireguard

systems/ren/system.nix

@@ -34,5 +34,6 @@ nixpkgs.lib.nixosSystem {
     ./hardware.nix
     agenix.nixosModules.default
     ./volumes.nix
+    (import ./wireguard.nix).systemModule
   ];
 }

systems/ren/users.nix

@@ -1,3 +1,4 @@
+{ pkgs, ... }:
 {
   users.users.ren = {
     isNormalUser = true;
@@ -24,5 +25,6 @@
     (builtins.readFile ../../keys/hetzner.pub)
   ];
   age.identityPaths = [ "/home/ren/.ssh/id_ed25519" ];
+  environment.systemPackages = [ pkgs.git ];
 
 }

systems/ren/wireguard.nix

@@ -0,0 +1,32 @@
+let 
+  ip = "10.100.0.3/32";
+  publicKey = (builtins.readFile ../../keys/wg-ren.pub);
+in
+{
+  systemModule = { config, ... }: {
+    age.secrets.wg-private.file = ../../keys/wg-ren.priv;
+    networking.wg-quick.interfaces.wg-selene = {
+      privateKeyFile = config.age.secrets.wg-private.path;
+
+      # The internal IP address assigned to this client by the server.
+      # The /24 subnet mask is important for knowing the VPN's local network.
+      address = [ ip ];
+
+      # DNS server(s) to use when the tunnel is active.
+      # This is critical for resolving hostnames when all traffic is routed.
+      dns = [
+        "1.1.1.1"
+        "1.0.0.1"
+      ]; # Cloudflare DNS, or use your preferred one like 8.8.8.8
+
+      peers = [
+        (import ../../modules/servermodules/wireguard/wireguard-server.nix).infoForClients
+      ];
+    };
+  };
+
+  peerConfig = {
+    publicKey = publicKey;
+    allowedIPs = [ip];
+  };
+}