fix

modules/nixos/system/network/wireguard/default.nix

@@ -1,4 +1,21 @@
-{ config, lib, pkgs, ... }: {
+{ config, lib, pkgs, ... }: let
+  systemsDir = ../../../../../systems;
+  systemNames = lib.attrNames (lib.filterAttrs 
+    (name: type: type == "directory" && builtins.pathExists (systemsDir + "/${name}/cfg.nix")) 
+    (builtins.readDir systemsDir));
+
+  # Use a helper to check if the attribute path exists safely
+  # This prevents the "attribute 'net' missing" error
+  isValidPeer = p: 
+    (p ? syscfg.net.wg.enable) && 
+    (p.syscfg.net.wg.enable == true) && 
+    (p.syscfg.net.wg.pubkey != config.syscfg.net.wg.pubkey);
+
+  importedConfigs = map (name: import (systemsDir + "/${name}/cfg.nix")) systemNames;
+
+  activePeers = builtins.filter isValidPeer importedConfigs;
+in
+{
   imports = [ ./forwarding.nix ];
   config = lib.mkIf (config.syscfg.net.wg.enable) {
     networking.wireguard = {
@@ -10,18 +27,13 @@
             config.sops.secrets."${config.syscfg.hostname}_wg_priv".path;
           listenPort = 1515;
           mtu = 1340;
-          postSetup = if config.syscfg.net.wg.server.enable then ''
-          for keyfile in /run/secrets/*_wg_pub; do
-            if [ -f "$keyfile" ]; then
-              ${pkgs.wireguard-tools}/bin/wg set wg0 \
-                peer "$(cat "$keyfile")" \
-                allowed-ips 10.10.1.0/24,fd10:10:10::0/64
-            fi
-          done
-          '' else '''';
           peers = 
             if config.syscfg.net.wg.server.enable then
-              []
+              map (p: {
+                name = p.syscfg.hostname;
+                publicKey = p.syscfg.net.wg.pubkey;
+                allowedIPs = [ p.syscfg.net.wg.ip4 p.syscfg.net.wg.ip6 ];
+              }) activePeers
             else
               [{
                 allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];

modules/server/sops/default.nix

@@ -16,5 +16,4 @@
     group = config.users.users.${config.syscfg.defaultUser}.group;
   };
   sops.secrets."${config.syscfg.hostname}_wg_priv" = { };
-  sops.secrets."${config.syscfg.hostname}_wg_pub" = { };
 }

modules/shared/sops/default.nix

@@ -28,12 +28,7 @@ in {
       group = config.users.users.${config.syscfg.defaultUser}.group;
     };
     "${config.syscfg.hostname}_wg_priv" = { };
-    "${config.syscfg.hostname}_wg_pub" = { };
   }
-  (lib.genAttrs 
-    (map (peer: "${peer}_wg_pub") config.syscfg.net.wg.server.peers)
-    (_: { mode = "0444"; })
-  )
   (lib.genAttrs 
     (map (peer: "${peer}_ssh_pub") ["iriy" "avalon" "valinor"])
     (_: { mode = "0444"; })

modules/shared/syscfg/default.nix

@@ -42,6 +42,10 @@ let
         type = types.str;
         default = "";
       };
+      pubkey = mkOption {
+        type = types.str;
+        default = "";
+      };
       server = {
         enable = mkOption {
           type = types.bool;