{ config, lib, pkgs, ... }: let cfg = config.orbekk.mullvad; in { options = { orbekk.mullvad = { enable = lib.mkEnableOption "Enable VPN"; listenPort = lib.mkOption { type = lib.types.port; default = 40421; description = "wireguard local port"; }; }; }; config = lib.mkIf cfg.enable { orbekk.simple-firewall.allowedUDPPorts = [ cfg.listenPort ]; networking.wireguard = { enable = true; interfaces.mullvad = { privateKeyFile = "/opt/secret/wireguard/mullvad.private"; ips = [ "10.64.128.156/32" "fc00:bbbb:bbbb:bb01::1:809b/128" ]; allowedIPsAsRoutes = false; listenPort = cfg.listenPort; peers = [ # Oslo # { # endpoint = "no4-wireguard.relays.mullvad.net:51820"; # publicKey = "veeEoYS9a2T6K8WMs/MvRCdNJG580XbhnLfbFjp3B0M="; # allowedIPs = [ "0.0.0.0/0" "::0/0" ]; # } # NYC { endpoint = "us276-wireguard.mullvad.net:51820"; publicKey = "4oR0oc3cyktCoQ1eygZ/EZeCNeI6eQnQJNRuBmRne2Q="; allowedIPs = [ "0.0.0.0/0" "::0/0" ]; } ]; }; }; }; }