1 files changed, 63 insertions, 55 deletions
diff --git a/modules/wireguard/default.nix b/modules/wireguard/default.nix
index c9fc063..345af3e 100644
--- a/modules/wireguard/default.nix
+++ b/modules/wireguard/default.nix
@@ -3,65 +3,73 @@
 with lib; {
   imports = [ ./options.nix ./roaming.nix ];
 
-  config = mkIf config.wireguard.enable (let
-    cfg = config.wireguard;
+  config = mkIf config.wireguard.enable (
+    let
+      cfg = config.wireguard;
 
-    peers = let
-      attrPeers = mapAttrs (n: node:
-        let peer = node.config.wireguard;
-        in {
-          endpoint =
-            "${node.config.deployment.targetHost}:${toString peer.port}";
-          publicKey = peer.publicKey;
-          persistentKeepalive = 25;
-          allowedIPs = [
-            "${peer.v4.address}/32"
-            "${peer.v6.ula}::${peer.v6.address}/128"
-            "${peer.v6.gua}::${peer.v6.address}/128"
-          ] ++ peer.allowedIPs;
-        }) (filterAttrs (n: node: node.config.wireguard.enable) nodes);
-      peers = attrValues attrPeers;
-    in peers;
-  in {
-    secrets = mkIf config.wireguard.enable {
-      wireguard = {
-        source = ../../secrets
-          + ("/" + "${config.networking.hostName}.privkey");
-        dest = "/root/wireguard/privkey";
+      peers =
+        let
+          attrPeers = mapAttrs
+            (n: node:
+              let peer = node.config.wireguard;
+              in
+              {
+                endpoint =
+                  "${node.config.deployment.targetHost}:${toString peer.port}";
+                publicKey = peer.publicKey;
+                persistentKeepalive = 25;
+                allowedIPs = [
+                  "${peer.v4.address}/32"
+                  "${peer.v6.ula}::${peer.v6.address}/128"
+                  "${peer.v6.gua}::${peer.v6.address}/128"
+                ] ++ peer.allowedIPs;
+              })
+            (filterAttrs (n: node: node.config.wireguard.enable) nodes);
+          peers = attrValues attrPeers;
+        in
+        peers;
+    in
+    {
+      secrets = mkIf config.wireguard.enable {
+        wireguard = {
+          source = ../../secrets
+            + ("/" + "${config.networking.hostName}.privkey");
+          dest = "/root/wireguard/privkey";
+        };
       };
-    };
 
-    networking.wireguard.interfaces = mkIf config.wireguard.enable {
-      wg0 = with { ifname = "wg0"; }; {
-        ips = [
-          "${cfg.v4.address}/${toString cfg.v4.prefixLength}"
-          "${cfg.v6.ula}::${cfg.v6.address}/128"
-          "${cfg.v6.gua}::${cfg.v6.address}/128"
-        ];
-        listenPort = cfg.port;
-        postSetup = ''
-          ${pkgs.nftables}/bin/nft add table ${ifname}
-          ${pkgs.nftables}/bin/nft 'add chain ${ifname} prerouting { type nat hook prerouting priority 0 ; }'
-          ${pkgs.nftables}/bin/nft 'add chain ${ifname} postrouting { type nat hook postrouting priority 100 ; }'
-          ${pkgs.nftables}/bin/nft add rule ${ifname} postrouting ip saddr ${cfg.v4.network}/${
-            toString cfg.v4.prefixLength
-          } oif ${cfg.natInterface} masquerade
+      networking.wireguard.interfaces = mkIf config.wireguard.enable {
+        wg0 = with { ifname = "wg0"; }; {
+          ips = [
+            "${cfg.v4.address}/${toString cfg.v4.prefixLength}"
+            "${cfg.v6.ula}::${cfg.v6.address}/128"
+            "${cfg.v6.gua}::${cfg.v6.address}/128"
+          ];
+          listenPort = cfg.port;
+          postSetup = ''
+            ${pkgs.nftables}/bin/nft add table ${ifname}
+            ${pkgs.nftables}/bin/nft 'add chain ${ifname} prerouting { type nat hook prerouting priority 0 ; }'
+            ${pkgs.nftables}/bin/nft 'add chain ${ifname} postrouting { type nat hook postrouting priority 100 ; }'
+            ${pkgs.nftables}/bin/nft add rule ${ifname} postrouting ip saddr ${cfg.v4.network}/${
+              toString cfg.v4.prefixLength
+            } oif ${cfg.natInterface} masquerade
 
-          ${pkgs.iproute2}/bin/ip link set ${ifname} multicast on
-        '';
-        postShutdown = ''
-          ${pkgs.nftables}/bin/nft flush table ${ifname}
-          ${pkgs.nftables}/bin/nft delete table ${ifname}
-        '';
-        privateKeyFile = "/root/wireguard/privkey";
-        peers = peers;
+            ${pkgs.iproute2}/bin/ip link set ${ifname} multicast on
+          '';
+          postShutdown = ''
+            ${pkgs.nftables}/bin/nft flush table ${ifname}
+            ${pkgs.nftables}/bin/nft delete table ${ifname}
+          '';
+          privateKeyFile = "/root/wireguard/privkey";
+          peers = peers;
+        };
       };
-    };
 
-    boot.kernel.sysctl = {
-      "net.ipv4.ip_forward" = lib.mkDefault true;
-      "net.ipv6.conf.all.forwarding" = true;
-      "net.netfilter.nf_conntrack_tcp_be_liberal" = true;
-    };
-  });
+      boot.kernel.sysctl = {
+        "net.ipv4.ip_forward" = lib.mkDefault true;
+        "net.ipv6.conf.all.forwarding" = true;
+        "net.netfilter.nf_conntrack_tcp_be_liberal" = true;
+      };
+    }
+  );
 }