wireguard

client.nix

wireguard.interfaces.wg0 = {
  ips = [ "10.100.0.2/24" ];

  privateKeyFile = "/home/asymmetric/wireguard-keys/private";

  peers = [
    {
      publicKey = "xPjzdx0RA9RuAR0HFA+VCLOglgeKKqVyTa3FXDX6Ejs=";
      allowedIPs = [ "10.100.0.1/32" ];
      endpoint = "159.69.55.136:51820";
      persistentKeepalive = 25;
    }
  ];
};

server.nix

networking.nat = {
  enable = true;
  externalInterface = "ens3";
  internalInterfaces = [ "wg0" ];
};
networking.wireguard.interfaces = {
  wg0 = {
    ips = [ "10.100.0.1/24" ];
    listenPort = 51820;
    privateKeyFile = "/root/wireguard-private-key";

    peers = [
      {
        # asymmetric@tachikoma
        publicKey = "gTqmM3TXHUAunBn59SJdKs9sDn0pMaPXdaFJXO3wxQM=";
        allowedIPs = [ "10.100.0.2/32" ];
      }
    ];
  };
};