ft: sops-nix + secrets

hosts/nixbook/default.nix

@@ -22,34 +22,4 @@
 
   # explicitly override videoDrivers (nvidia doesnt like us on nixbook )
   services.xserver.videoDrivers = lib.mkForce [ "intel" ];
-
-  # BELOW IS OLD!! remove as we make more modular
-  # TODO: move certs to secrets, make this a module not a host based thing
-  # custom certificates
-  # security.pki.certificateFiles = [
-  #   ./certs/npm-caddy-private.crt
-  #   ./certs/npm-caddy-public.crt
-  #   ./certs/npm-caddy-shared.crt
-  # ];
-
-  # TODO: move to secrets
-  # tunnel
-  networking.wg-quick.interfaces = {
-    npm = {
-      address = [ "10.8.0.3/32" ];
-      privateKeyFile = "/root/wireguard-keys/npm";
-      peers = [
-        {
-          publicKey = "YlQfDLqOET0RCTfbeRTDUicF/RA6dic/ThHLy25w4nQ=";
-          presharedKeyFile = "/root/wireguard-keys/npm_preshared";
-          allowedIPs = [
-            "10.9.11.0/24"
-            "10.8.0.0/24"
-          ];
-          endpoint = "wg-easy.u.djairo.dev:51820";
-          persistentKeepalive = 25;
-        }
-      ];
-    };
-  };
 }

hosts/nixbook/wireguard.nix

@@ -0,0 +1,8 @@
+{ ... }:
+
+{
+  networking.wg-quick.interfaces.npm = {
+    configFile = config.sops.secrets."wg-config-nixbook".path;
+    autostart = true;
+  };
+}