Setup Wireguard configuration

darwin/default.nix

@@ -8,6 +8,7 @@
     ./settings.nix
     ./homebrew.nix
     ./yabai.nix
+    ./wireguard.nix
   ];
 
   # nix config

darwin/wireguard.nix

@@ -0,0 +1,40 @@
+{
+  config,
+  pkgs,
+  hostName,
+  ...
+}:
+{
+  sops.secrets."wireguard/${hostName}" = {
+    mode = "0400";
+  };
+
+  launchd.daemons.wireguard = {
+    script = ''
+      set -e
+      mkdir -p /etc/wireguard
+      PRIVATE_KEY=$(cat ${config.sops.secrets."wireguard/${hostName}".path})
+      cat > /etc/wireguard/wg0.conf << EOF
+      [Interface]
+      Address = $WG_IP
+      PrivateKey = $PRIVATE_KEY
+
+      [Peer]
+      PublicKey = NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=
+      Endpoint = 178.254.8.35:51820
+      AllowedIPs = 10.10.0.0/24
+      PersistentKeepalive = 25
+      EOF
+      chmod 600 /etc/wireguard/wg0.conf
+      ${pkgs.wireguard-tools}/bin/wg-quick up wg0
+    '';
+    environment.WG_IP = "";
+    serviceConfig = {
+      Label = "org.wireguard.wg0";
+      RunAtLoad = true;
+      KeepAlive = false;
+      StandardOutPath = "/var/log/wireguard.log";
+      StandardErrorPath = "/var/log/wireguard.log";
+    };
+  };
+}

hosts/cyper-controller/configuration.nix

@@ -22,6 +22,17 @@
     useNetworkd = true;
     useDHCP = false;
     firewall.enable = true;
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.10.0.2/24" ];
+      peers = [
+        {
+          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
+          endpoint = "178.254.8.35:51820";
+          allowedIPs = [ "10.10.0.0/24" ];
+          persistentKeepalive = 25;
+        }
+      ];
+    };
   };
 
   systemd.network = {

hosts/cyper-desktop/configuration.nix

@@ -6,6 +6,17 @@
     useNetworkd = true;
     useDHCP = false;
     firewall.enable = true;
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.10.0.40/24" ];
+      peers = [
+        {
+          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
+          endpoint = "178.254.8.35:51820";
+          allowedIPs = [ "10.10.0.0/24" ];
+          persistentKeepalive = 25;
+        }
+      ];
+    };
   };
 
   systemd.network = {

hosts/cyper-mac/configuration.nix

@@ -1 +1,3 @@
-{ ... }: { }
+{
+  launchd.daemons.wireguard.environment.WG_IP = "10.10.0.3/24";
+}

hosts/cyper-node-1/configuration.nix

@@ -8,6 +8,17 @@
     useNetworkd = true;
     useDHCP = false;
     firewall.enable = true;
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.10.0.30/24" ];
+      peers = [
+        {
+          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
+          endpoint = "178.254.8.35:51820";
+          allowedIPs = [ "10.10.0.0/24" ];
+          persistentKeepalive = 25;
+        }
+      ];
+    };
   };
 
   systemd.network = {

hosts/cyper-node-2/configuration.nix

@@ -8,6 +8,17 @@
     useNetworkd = true;
     useDHCP = false;
     firewall.enable = true;
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.10.0.31/24" ];
+      peers = [
+        {
+          publicKey = "NjMYaUZO/iPRM/J46qyPPuWYg5oSeAUxjocMs/hYTXs=";
+          endpoint = "178.254.8.35:51820";
+          allowedIPs = [ "10.10.0.0/24" ];
+          persistentKeepalive = 25;
+        }
+      ];
+    };
   };
 
   systemd.network = {

hosts/cyper-proxy/configuration.nix

@@ -37,9 +37,37 @@
       "178.254.16.141"
     ];
 
+    wireguard.interfaces.wg0 = {
+      ips = [ "10.10.0.1/24" ];
+      listenPort = 51820;
+      peers = [
+        {
+          publicKey = "EvML4de3CReNW8aF+lJAsPZ+p6FICOyjCsAZJBwIwX8=";
+          allowedIPs = [ "10.10.0.2/32" ];
+        }
+        {
+          publicKey = "WkY45tGnNZQuJTf1MPN6I92spxHts/kpzXRSZE9se2c=";
+          allowedIPs = [ "10.10.0.3/32" ];
+        }
+        {
+          publicKey = "oAstNd7Wxpj2PqSyS87q+8y8WtaLK7hZ5Ytfncml9EM=";
+          allowedIPs = [ "10.10.0.40/32" ];
+        }
+        {
+          publicKey = "GrFH3I5QqjRij7Jl+eOL6Ou6zK6MtH5/kAsA5AmGckM=";
+          allowedIPs = [ "10.10.0.30/32" ];
+        }
+        {
+          publicKey = "IddGAijZVCVxGj/aMasjfroIy9r8Owar4MO9xfvNNBY=";
+          allowedIPs = [ "10.10.0.31/32" ];
+        }
+      ];
+    };
+
     firewall.allowedTCPPorts = [
       80
       443
+      51820
     ];
 
     hosts = {

hosts/cyper-proxy/hardware-configuration.nix

@@ -16,6 +16,7 @@
       ];
       kernelModules = [ ];
     };
+    kernel.sysctl."net.ipv4.ip_forward" = 1;
     kernelModules = [ ];
     extraModulePackages = [ ];
   };
@@ -30,10 +31,9 @@
         "mode=755"
       ];
     };
+
+    "/nix".neededForBoot = true;
+    "/persist".neededForBoot = true;
   };
-
-  fileSystems."/nix".neededForBoot = true;
-  fileSystems."/persist".neededForBoot = true;
-
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

nixos/default.nix

@@ -11,7 +11,7 @@
   imports = [
     ./sops.nix
     ./locale.nix
-    ./tailscale.nix
+    ./wireguard.nix
     ./ssh.nix
     ./impermanence.nix
   ]

nixos/tailscale.nix

@@ -1,10 +0,0 @@
-{ config, ... }:
-{
-  sops.secrets.tailscale_auth_key = { };
-
-  services.tailscale = {
-    enable = true;
-    openFirewall = true;
-    authKeyFile = config.sops.secrets.tailscale_auth_key.path;
-  };
-}

nixos/wireguard.nix

@@ -0,0 +1,14 @@
+{ config, hostName, ... }:
+{
+  sops.secrets."wireguard/${hostName}" = {
+    mode = "0400";
+  };
+
+  networking = {
+    wireguard.interfaces.wg0 = {
+      privateKeyFile = config.sops.secrets."wireguard/${hostName}".path;
+    };
+    firewall.allowedUDPPorts = [ 51820 ];
+  };
+
+}

secrets/secrets.yaml

@@ -35,6 +35,13 @@ ssh_private_key: ENC[AES256_GCM,data:R511mVFVk1ogAd5CKk/2P6rtT4NnHIFfKyqeCen545Q
 ssh_github_key: ENC[AES256_GCM,data:vZAH4cRDsgGXLAppQKOyUPOvmBJZ27bujMGz4hQ8tt0xhGFUP28llwGZz/VRuU02Yv4alLgVWBAIPuyhZT9f35KnjIR1Mmb7HXk/6oaNM59/lBiISLrnOpC10WmJ9O5krKdxwP8ZDvHA34B0s+oYNkTNXiU0S8AVg3icploax7ylKH5Dorj53kjdYSTjd8KN6ZsgCKmcz97+GnP0IgdmauyNL7e+kv9WIfE8Xx1kGvC8WVnidX2YhSxm6vt8l60eUj9etRigU88oFYTDZ+mIf4lucSpzaLZutz2fM/16D/o9SS7mmTrEllj2S+IXc9ZZTRKKDLbW+yv0XUi0XZi+OHAdZScjS54NZKyT9uWrc/IDJHammGsoHRQpHZtbGhkeFi/KdJsYBsWItslXjM0xJVtFIM2tMnd10kv9UGuXsSl9J4NC0rpz3aXnQqG4ZAhMjN9D/DTJpB4K0pcFyd2FDWdrbKq5iPfnU/V6ecnHPML6wCt6gua/LdK1MWoG3l2SqwMLYj1r7UW5fQZqSw1EK0BAtp9cQMLBL/2w8ykMfWpLekE=,iv:gcinU7xOoXQkFVkLNB3sQYHAcZy3pZN+bDRIq4sspys=,tag:yawgAHBKIkGpnKPHsRId4g==,type:str]
 nix_cache_priv_key: ENC[AES256_GCM,data:FbRHM4n7BDMDgZYtTOdpS0SQx80afxMC3uw6PtdKb1zcAjyQRYwJe0esTDLklLDh8Kx6dgZOJbrf2sYIzF5xVv09U1Uz0C1UnF4M6yhbg+Nqg0HfVj55L3Z6ulrxNlgq7gY=,iv:F9DZUsyzZocKoB0yByeBcrCw9Ytcp+Xk6y8+ZH4OV7k=,tag:mSf1zVciPkifzr3kVFAt0g==,type:str]
 tailscale_auth_key: ENC[AES256_GCM,data:jJU2WKuiYTLcYyoCXeBMpc/mmjOH6JupIofo5CQbs0bGcnBrv3wNtmI2TR2dqdyohx9d7DJUkjrIgi2OWRI=,iv:zWPqc7cErVZaI6vRbSbPrcEKZmKCoEsDKhnjKTlgsJA=,tag:TLwUzfyyKnmOuWdpTG7Uow==,type:str]
+wireguard:
+    cyper-proxy: ENC[AES256_GCM,data:ohe1JLavTPpEcQl+EGPcmJodBn6KaLf7S7aCLrHEgROklcX28Yjm1m4uW0Q=,iv:4iEO3ay0sqaRUxsqR3P7XFpbD6mnnq73yNsZbT22iGU=,tag:HwQaId/xi6OF99z9bZf6ew==,type:str]
+    cyper-desktop: ENC[AES256_GCM,data:pABywoxw/BURnpwCfsvXD7jmN+fa6NyHmJIKpR6pkTUNHE2h1xsD64M54JE=,iv:UcDWk1ULbbxBDad/MDD94Iaj2bB/xlpLWtsuPTP6E7c=,tag:La/PWVzumCusn9IaAFkxwQ==,type:str]
+    cyper-controller: ENC[AES256_GCM,data:q85Tw7GGuoMlsRPDlPJ0n3aUw3cOejmjDwxSBr6Jkw+L7ZAU9yz7vthIpho=,iv:CdHhEqAOBMqsa3ZWD2RIoTlyObBpnUQhdZncmq8u7W0=,tag:tCYXugIb7rQDkgwRsY023Q==,type:str]
+    cyper-node-1: ENC[AES256_GCM,data:+Des2tr8Fja0IarMmn6xc2bjYIlwfoVmdXMRC8yyenIrke+SS09/VV8ed/A=,iv:xL6gxjur1FNDtziNP/bEGyUXZ9VD9wmxHmWb6BR3xig=,tag:RGLuXGMAJSaREE9b9RnnfA==,type:str]
+    cyper-node-2: ENC[AES256_GCM,data:0vjNM8xgHXQtKDeKD6NBYjn3jpt9NMsLgaxZOzb9wgg1HTeLjwhK7Xw12Co=,iv:CETgdC0nKP5n8XMZj++bXWUY/harcJu+wj3S3ksLE0U=,tag:6EHF7DWi0ruKjJht1ndWcA==,type:str]
+    cyper-mac: ENC[AES256_GCM,data:8MSy7ALUwYyk42CpIuiym4L3VIn0MSyxr0M1Gz+t/hAwzNdvWQkYUZirZ+Q=,iv:eUbXRhhR3/ZQGJE/Uf0bISWx1YeOuPqhhMBo4CwF23w=,tag:mgfXWrEWyS3AsvlA6EJq8g==,type:str]
 sops:
     age:
         - enc: |
@@ -46,7 +53,7 @@ sops:
             6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w==
             -----END AGE ENCRYPTED FILE-----
           recipient: age10pyhca0jy75wtqv5hrn0gf0jcam5272zx9h73a8xwwaxyfq89c0qs5dr9t
-    lastmodified: "2026-06-28T21:28:16Z"
+    lastmodified: "2026-06-29T09:16:03Z"
-    mac: ENC[AES256_GCM,data:PTeAIxRx+TWjvLrIrh5KHsxRtIIMJxXQIb1b3Q50Kx11toNnijmrjIRjPgrT//D+9KMyTqJCXK8mZ3VFW/658fawsxbfLQuOyVP2XI2vl77Cc+aZDDTsCrHZkcMn1VHZuoPRqZP4yZm9H8RkAqtdLg1WB7WTcJso3MiDWf9tBRk=,iv:qPRtIyUFE1xuficyrfmSua9CvuU1IYZmCtcaXOQeXkg=,tag:ZrEbRsVjyVHMLYuuYAcGzw==,type:str]
+    mac: ENC[AES256_GCM,data:IN9vRP9kYa/KRo2R6A/g2azBLOj/twoX4NY88iT9JG092QVeeSmvgDoQ+heb0b8rBcfFbEtVFZkGZkjr9eUBfp2gaFw1j958PahH/Mm03R++SSoYr29yHlPkBuWUkQzhUv4vQ8nQQvueY8U9FmFEUoP6uV+MBhYkhUyAsONWGZk=,iv:H6zeAUndn98wTGs1elTVPkLJDYbm/n5l5wdD9HBU8qU=,tag:PAYt8w3X/6o+z3h3NHINRA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1