Setup Wireguard configuration

darwin/default.nix

@@ -8,6 +8,7 @@
     ./settings.nix
     ./homebrew.nix
     ./yabai.nix
+    ./wireguard.nix
   ];
 
   # nix config

darwin/wireguard.nix

@@ -0,0 +1,40 @@
+{
+  config,
+  pkgs,
+  hostName,
+  ...
+}:
+{
+  sops.secrets."wireguard/${hostName}" = {
+    mode = "0400";
+  };
+
+  launchd.daemons.wireguard = {
+    script = ''
+      set -e
+      mkdir -p /etc/wireguard
+      PRIVATE_KEY=$(cat ${config.sops.secrets."wireguard/${hostName}".path})
+      cat > /etc/wireguard/wg0.conf << EOF
+      [Interface]
+      Address = $WG_IP
+      PrivateKey = $PRIVATE_KEY
+
+      [Peer]
+      PublicKey = NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=
+      Endpoint = 178.254.8.35:51820
+      AllowedIPs = 10.10.0.0/24
+      PersistentKeepalive = 25
+      EOF
+      chmod 600 /etc/wireguard/wg0.conf
+      ${pkgs.wireguard-tools}/bin/wg-quick up wg0
+    '';
+    environment.WG_IP = "";
+    serviceConfig = {
+      Label = "org.wireguard.wg0";
+      RunAtLoad = true;
+      KeepAlive = false;
+      StandardOutPath = "/var/log/wireguard.log";
+      StandardErrorPath = "/var/log/wireguard.log";
+    };
+  };
+}