Fix

modules/nixos/system/network/wireguard/default.nix

@@ -1,4 +1,21 @@
-{ config, lib, pkgs, ... }: {
+{ config, lib, pkgs, ... }: let
+  systemsDir = ../../../../../systems;
+  systemNames = lib.attrNames (lib.filterAttrs 
+    (name: type: type == "directory" && builtins.pathExists (systemsDir + "/${name}/cfg.nix")) 
+    (builtins.readDir systemsDir));
+
+  # Use a helper to check if the attribute path exists safely
+  # This prevents the "attribute 'net' missing" error
+  isValidPeer = p: 
+    (p ? syscfg.net.wg.enable) && 
+    (p.syscfg.net.wg.enable == true) && 
+    (p.syscfg.net.wg.pubkey != config.syscfg.net.wg.pubkey);
+
+  importedConfigs = map (name: import (systemsDir + "/${name}/cfg.nix")) systemNames;
+
+  activePeers = builtins.filter isValidPeer importedConfigs;
+in
+{
   imports = [ ./forwarding.nix ];
   config = lib.mkIf (config.syscfg.net.wg.enable) {
     networking.wireguard = {
@@ -10,18 +27,13 @@
             config.sops.secrets."${config.syscfg.hostname}_wg_priv".path;
           listenPort = 1515;
           mtu = 1340;
-          postSetup = if config.syscfg.net.wg.server.enable then ''
-          for keyfile in /run/secrets/*_wg_pub; do
-            if [ -f "$keyfile" ]; then
-              ${pkgs.wireguard-tools}/bin/wg set wg0 \
-                peer "$(cat "$keyfile")" \
-                allowed-ips 10.10.1.0/24,fd10:10:10::0/64
-            fi
-          done
-          '' else '''';
           peers = 
             if config.syscfg.net.wg.server.enable then
-              []
+              map (p: {
+                name = p.syscfg.hostname;
+                publicKey = p.syscfg.net.wg.pubkey;
+                allowedIPs = [ p.syscfg.net.wg.ip4 p.syscfg.net.wg.ip6 ];
+              }) activePeers
             else
               [{
                 allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];

modules/server/sops/default.nix

@@ -16,5 +16,4 @@
     group = config.users.users.${config.syscfg.defaultUser}.group;
   };
   sops.secrets."${config.syscfg.hostname}_wg_priv" = { };
-  sops.secrets."${config.syscfg.hostname}_wg_pub" = { };
 }

modules/shared/sops/default.nix

@@ -28,12 +28,7 @@ in {
       group = config.users.users.${config.syscfg.defaultUser}.group;
     };
     "${config.syscfg.hostname}_wg_priv" = { };
-    "${config.syscfg.hostname}_wg_pub" = { };
   }
-  (lib.genAttrs 
-    (map (peer: "${peer}_wg_pub") config.syscfg.net.wg.server.peers)
-    (_: { mode = "0444"; })
-  )
   (lib.genAttrs 
     (map (peer: "${peer}_ssh_pub") ["iriy" "avalon" "valinor"])
     (_: { mode = "0444"; })

modules/shared/syscfg/default.nix

@@ -42,6 +42,10 @@ let
         type = types.str;
         default = "";
       };
+      pubkey = mkOption {
+        type = types.str;
+        default = "";
+      };
       server = {
         enable = mkOption {
           type = types.bool;

systems/avalon/cfg.nix

@@ -26,10 +26,13 @@
       cli = true;
       virt = true;
     };
-    wg = {
+    net = {
-      enable = true;
+      wg = {
-      ip4 = "10.10.1.2/32";
+        enable = true;
-      ip6 = "fd10:10:10::2/128";
+        ip4 = "10.10.1.2/32";
+        ip6 = "fd10:10:10::2/128";
+        pubkey = "QlvpTiK6s/lIha9vKmo+teSy2Nw52qWLYatYjxVan3U=";
+      };
     };
   };
 }

systems/gateway/cfg.nix

@@ -22,6 +22,7 @@
         enable = true;
         ip4 = "10.10.1.1/32";
         ip6 = "fd10:10:10::1/128";
+        pubkey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
         server = {
             enable = true;
             peers = ["avalon" "iriy" "valinor"];

systems/gateway/default.nix

@@ -1,6 +1,6 @@
-{ config, inputs, ... }: {
+{ config, lib, inputs, ... }: {
   imports = [ ./hardware.nix ];
-  
+
   services.openssh.enable = true;
   services.openssh.authorizedKeysFiles = [
     config.sops.secrets."iriy_ssh_pub".path

systems/gateway/hardware.nix

@@ -1,7 +1,16 @@
 { config, lib, pkgs, modulesPath, ... }: {
   boot.kernelPackages = pkgs.linuxPackages_latest;
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  boot.loader.grub.device = "/dev/sda";
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/sda";
+    efiSupport = true;
+    efiInstallAsRemovable = true;# CRITICAL: This overwrites /boot/EFI/BOOT/BOOTX64.EFI
+  };
+
   boot.initrd.availableKernelModules =
     [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
   boot.initrd.kernelModules = [ "nvme" ];

systems/iriy/cfg.nix

@@ -30,6 +30,7 @@
         enable = true;
         ip4 = "10.10.1.7/32";
         ip6 = "fd10:10:10::7/128";
+        pubkey = "6d1bINFmH12ACAJLDOwfFIZgmNHV/FGGk0YJyDP50HQ=";
       };
     };
   };

systems/valinor/cfg.nix

@@ -31,6 +31,7 @@
         enable = true;
         ip4 = "10.10.1.5/32";
         ip6 = "fd10:10:10::5/128";
+        pubkey = "EUYd/dMdGcbxiWJXHhQhCXV00cr87pxiW1HExwCTGg0=";
       };
     };
   };