gistfile1.txt

{ config, lib, pkgs, ... }:

let
  machines = import ./machines.nix;

in

{
  services.nix-serve = {
    enable = true;
    port = 5000;
    bindAddress = machines.${config.networking.hostName}.wireguard_ip;
    secretKeyFile = "/var/secrets/nix/secret_key";
  };

  nix = {
    allowedUsers = [ "nix-serve" ];
    extraOptions = ''
      secret-key-files = /var/secrets/nix/secret_key
      # Keep source tarballs
      keep-outputs = true
    '';
  };

  networking.firewall = {
    extraCommands =
      ''
        iptables -A nixos-fw -p tcp -i wg0 --dport 5000 -j nixos-fw-accept # nix-serve
      '';
  };
}