wg-home: unify server and client config

hosts/by-name/lappy/default.nix

@@ -1,10 +1,12 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 {
   imports = [
     ./fs.nix
   ];
 
   sane.roles.client = true;
+  sane.services.wg-home.enable = true;
+  sane.services.wg-home.ip = config.sane.hosts.by-name."lappy".wg-home.ip;
 
   # sane.packages.enableDevPkgs = true;
 

hosts/by-name/servo/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 
 {
   imports = [
@@ -8,6 +8,9 @@
     ./secrets.nix
     ./services
   ];
+  o
+  sane.services.wg-home.enable = true;
+  sane.services.wg-home.ip = config.sane.hosts.by-name."servo".wg-home.ip;
 
   sane.packages.extraUserPkgs = with pkgs; [
     # for administering services

hosts/modules/hosts.nix

@@ -22,6 +22,7 @@ let
       };
       wg-home.pubkey = mkOption {
         type = types.nullOr types.str;
+        default = null;
         description = ''
           wireguard public key for the wg-home VPN.
           e.g. "pWtnKW7f7sNIZQ2M83uJ7cHg3IL1tebE3IoVkCgjkXM=".
@@ -29,11 +30,16 @@ let
       };
       wg-home.ip = mkOption {
         type = types.nullOr types.str;
+        default = null;
         description = ''
           IP address to use on the wg-home VPN.
           e.g. "10.0.10.5";
         '';
       };
+      wg-home.endpoint = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+      };
       lan-ip = mkOption {
         type = types.str;
         description = ''
@@ -83,6 +89,8 @@ in
       ssh.host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfdSmFkrVT6DhpgvFeQKm3Fh9VKZ9DbLYOPOJWYQ0E8";
       wg-home.pubkey = "roAw+IUFVtdpCcqa4khB385Qcv9l5JAB//730tyK4Wk=";
       wg-home.ip = "10.0.10.5";
+      # wg-home.endpoint = "uninsane.org:51820";
+      wg-home.endpoint = "97.126.41.123:51820";
       lan-ip = "192.168.0.5";
     };
   };

hosts/modules/roles/client/default.nix

@@ -9,13 +9,9 @@ in
     ./wifi-pairings.nix
   ];
 
+  # option is consumed by the other imports in this dir
   options.sane.roles.client = mkOption {
     type = types.bool;
     default = false;
   };
-
-  config = mkIf config.sane.roles.client {
-    sane.services.wg-home.enable = true;
-    sane.services.wg-home.role = "client";
-  };
 }

hosts/modules/wg-home.nix

@@ -1,8 +1,7 @@
 { config, lib, pkgs, ... }:
 
 let
-  inherit (builtins) mapAttrsToList;
+  inherit (lib) mapAttrsToList mkIf mkMerge mkOption optionalAttrs types;
-  inherit (lib) mkIf mkMerge mkOption optionalAttrs types;
   cfg = config.sane.services.wg-home;
   server-cfg = config.sane.hosts.by-name."servo".wg-home;
 in
@@ -12,13 +11,12 @@ in
       type = types.bool;
       default = false;
     };
-    sane.services.wg-home.role = mkOption {
+    sane.services.wg-home.ip = mkOption {
-      type = types.enum [ "client" "server" ];
+      type = types.str;
     };
   };
 
-  config = mkIf cfg.enable (mkMerge [
+  config = mkIf cfg.enable {
-    {
     # generate a (deterministic) wireguard private key
     sane.derived-secrets."/run/wg-home.priv" = {
       len = 32;
@@ -39,46 +37,29 @@ in
           gen-key = config.sane.fs."/run/wg-home.priv".unit;
         in
           "${pkgs.systemd}/bin/systemctl start '${gen-key}'";
-      };
-    }
 
-    {
-      networking.wireguard.interfaces.wg-home = lib.mkIf (cfg.role == "client") {
-        # client IP (TODO: make host-specific)
-        ips = [ "10.0.10.20/24" ];
-
-        peers = [
-          {
-            # server pubkey
-            publicKey = server-cfg.pubkey;
-
-            # accept traffic from any IP addr on the other side of the tunnel
-            # allowedIPs = [ "0.0.0.0/0" ];
-            allowedIPs = [ "10.0.10.5/32" ];
-
-            # endpoint = "uninsane.org:51820";
-            endpoint = "97.126.41.123:51820";
-
-            # send keepalives every 25 seconds to keep NAT routes live
-            persistentKeepalive = 25;
-          }
-        ];
-      };
-    }
-    {
-      networking.wireguard.interfaces.wg-home = lib.mkIf (cfg.role == "server") {
       ips = [
-          "10.0.10.5/24"
+        "${cfg.ip}/24"
       ];
+
+      # include all peers -- except for ourself
       peers = mapAttrsToList
         (name: hostcfg:
-            lib.mkIf (hostcfg.wg-home.ip or server-cfg.ip != server-cfg.ip) {
+          mkIf (hostcfg.wg-home.ip != null && hostcfg.wg-home.ip != cfg.ip) {
             publicKey = hostcfg.wg-home.pubkey;
             allowedIPs = [ "${hostcfg.wg-home.ip}/32" ];
+            endpoint = lib.mkIf
+              (hostcfg.wg-home.endpoint != null)
+              hostcfg.wg-home.endpoint;
+
+            # send keepalives every 25 seconds to keep NAT routes live.
+            # only need to do this from client -> server though, i think.
+            persistentKeepalive = lib.mkIf
+              (hostcfg.wg-home.endpoint != null)
+              25;
           }
         )
         config.sane.hosts.by-name;
     };
-    }
+  };
-  ]);
 }