Create preliminary documentation for age key generation and implement wireguard setup.

nix-system-configs/modules/secrets-config/notes.md

@@ -0,0 +1,6 @@
+To generate the keys beforehand
+```ssh
+nix-shell -p age
+/var/lib/sops-nix/key.txt
+```
+And then update the .sops.yaml in the project directory accordingly.

nix-system-configs/modules/system/wireguard_server.nix

@@ -0,0 +1,101 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  options.local = {
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default = "nixos-default";
+      description = "System hostname";
+    };
+    username = lib.mkOption {
+      type = lib.types.str;
+      default = "user";
+      description = "Primary user username";
+    };
+    userDescription = lib.mkOption {
+      type = lib.types.str;
+      default = "NixOS User";
+      description = "Primary user description";
+    };
+    address = lib.mkOption {
+      type = lib.types.str;
+      default = "10.1.1.100";
+      description = "Static IP address";
+    };
+  };
+
+  imports = [
+    ./modules/desktop-manager/sway_greetd_homemanager.nix
+    ./modules/local/hostname_username.nix
+    ./modules/local/networking_local.nix
+    ./modules/bootloader/seabios-assigned-iso-at-birth.nix
+    ./modules/lix-default.nix
+    # Optionally to enable remote building: ./modules/toolsets/remote_building.nix
+    #./modules/songsheet/wavelog/docker-compose.nix
+    #./modules/secrets-config/sops-the-blank-system.nix
+  ];
+
+  config = {
+    # https://wiki.archlinux.org/title/WireGuard
+    # https://wiki.nixos.org/wiki/WireGuard
+    local.hostname = "nixos-local-wireguard-server";
+    local.username = "wireguardprg_local";
+    local.userDescription = "NixOS PRG OpenVPN Service (Local)";
+    local.address = "10.1.1.6";
+    system.stateVersion = "25.11";
+
+    # enable NAT
+    networking.nat = {
+      enable = true;
+      enableIPv6 = true;
+      externalInterface = "ens18";
+      internalInterfaces = ["wg0"];
+    };
+
+    networking.wireguard.interfaces = {
+      wg0 = {
+        listenPort = 51820;
+
+        # This allows the wireguard server to route your traffic to the internet and hence be like a VPN
+        # Note: You ***really should*** to use IPv6 addresses, to ensure that there is no long term risk of *local* IPv4 address exhaustion.
+        # How IPv6 works - Basically imagine IPv4 with hexadecimal, but without forcing you to learn it, the handrule
+        # for local assignments is to start with fc00::, where appending "1" after the infix `::` as suffix gives you a proper address,
+        # "fc00::1" (imagine this as 10.0.0.1 in IPv4 thought, where technically it is "252.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1"
+        # in IPv6 dotted hexadecimal notation).
+        # Then you can add additional infix before the suffix to go more inside of the address prefix space, for example "fc00::1:1"
+        # becomes in IPv4 thinking as 10.0.1.1 (in IPv6 "	252.0.0.0.0.0.0.0.0.0.0.0.0.1.0.255").
+        # As you might have noticed, that each semicolon is assigned into 16 bits, thus you can assign each subnet address from
+        # in IPv4 like-thinking from .1 to .65536, thus in hexadecimal from ::1 to ::ffff.
+        # Prefixes are read 1:1 from IPv4 thinking, but you have 1 to 128 length range, instead of 1 to 31.
+
+        # IPv6 IP assignments, let us use the following IPv6 network range pre-set "fc00:5182::" aka. "252.0.81.130.0.0.0.0.0.0.0.0.0.0.0.0"
+        # Why? Because we just be just in case and consistent with documenting to everyone.
+        # Why 5182(0)? WireGuard server is running on port 51820,
+        # thus we can use the "5182" infix in the IPv6 prefix to make it more memorable and less likely to cause confusion
+        # with other local network services in the future.
+        postUp = ''
+          ${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg0 -j ACCEPT
+          ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fc00:5182::1:1/112  -o eth0 -j MASQUERADE
+        '';
+
+        # Undo the above
+        preDown = ''
+          ${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg0 -j ACCEPT
+          ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fc00:5182::1:1/112 -o eth0 -j MASQUERADE
+        '';
+
+        privateKeyFile = config.sops.secrets.wireguard_private.path;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [
+      51820
+    ];
+    networking.firewall.allowedUDPPorts = [
+      51820
+    ];
+  };
+}

nix-system-configs/modules/toolsets/wireguard_peer.nix

@@ -0,0 +1,43 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  networking.firewall.allowedUDPPorts = [51820];
+
+  networking.wireguard = {
+    enable = true;
+    interfaces = {
+      # network interface name.
+      # You can name the interface arbitrarily.
+      wg0 = {
+        # the IP address and subnet of this peer
+        #ips = ["fc00:5182::1:2/112"];
+        ips = [config.local.wireguard-peer-ip];
+
+        # WireGuard Port
+        # Must be accessible by peers
+        listenPort = config.local.wireguard-peer-port or 51820;
+
+        peers = [
+          {
+            ## NOTE! CHECK THE .sops.yaml and RUN SOPS `sops updatekeys`!
+            name = config.local.wireguard-peer-name or "default-wireguard-peer";
+            publicKey = config.sops.secrets.wireguard_public;
+            preSharedKey = config.sops.secrets.wireguard_preshared;
+            allowedIPs = [
+              "::/0" # Route all IPv6 traffic through the VPN, TODO: Dynamic Function to choose between different options
+            ];
+            endpoint = "wireguard.prg-radio.org:51820";
+            #  ToDo: route to endpoint not automatically configured
+            # https://wiki.archlinux.org/index.php/WireGuard#Loop_routing
+            # https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577
+            # Send keepalives every 25 seconds. Important to keep NAT tables alive.
+            persistentKeepalive = 60;
+          }
+        ];
+      };
+    };
+  };
+}