Fix

flake.lock

@@ -174,11 +174,11 @@
     },
     "nixUnstable": {
       "locked": {
-        "lastModified": 1776949667,
-        "narHash": "sha256-GMSVw35Q+294GlrTUKlx087E31z7KurReQ1YHSKp5iw=",
+        "lastModified": 1777548390,
+        "narHash": "sha256-WacE23EbHTsBKvr8cu+1DFNbP6Rh1brHUH5SDUI0NQI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "01fbdeef22b76df85ea168fbfe1bfd9e63681b30",
+        "rev": "7aaa00e7cc9be6c316cb5f6617bd740dd435c59d",
         "type": "github"
       },
       "original": {
@@ -190,11 +190,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1776734388,
-        "narHash": "sha256-vl3dkhlE5gzsItuHoEMVe+DlonsK+0836LIRDnm6MXQ=",
+        "lastModified": 1777428379,
+        "narHash": "sha256-ypxFOeDz+CqADEQNL72haqGjvZQdBR5Vc7pyx2JDttI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "10e7ad5bbcb421fe07e3a4ad53a634b0cd57ffac",
+        "rev": "755f5aa91337890c432639c60b6064bb7fe67769",
         "type": "github"
       },
       "original": {
@@ -221,11 +221,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1776877367,
-        "narHash": "sha256-EHq1/OX139R1RvBzOJ0aMRT3xnWyqtHBRUBuO1gFzjI=",
+        "lastModified": 1777268161,
+        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "0726a0ecb6d4e08f6adced58726b95db924cef57",
+        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
         "type": "github"
       },
       "original": {
@@ -241,11 +241,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1777162113,
-        "narHash": "sha256-76X5+aK1TyKAcuSCJHBI2p51Kd81xEQ0AEl3aQNlbQU=",
+        "lastModified": 1777684559,
+        "narHash": "sha256-0QXkkTPUnHLeMjb+FYVbCSbboVkTjeEnyPXOzb7A2Z0=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "d6d97ae13c82041a36b4f3cff4af35b54f0e40ba",
+        "rev": "ed879a8036a7255c34ec4b17dd4db087bff8f874",
         "type": "github"
       },
       "original": {
@@ -274,11 +274,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776771786,
-        "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=",
+        "lastModified": 1777338324,
+        "narHash": "sha256-bc+ZZCmOTNq86/svGnw0tVpH7vJaLYvGLLKFYP08Q8E=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598",
+        "rev": "8eaee5c45428b28b8c47a83e4c09dccec5f279b5",
         "type": "github"
       },
       "original": {

modules/nixos/system/network/wireguard/default.nix

@@ -1,4 +1,21 @@
-{ config, lib, pkgs, ... }: {
+{ config, lib, pkgs, ... }: let
+  systemsDir = ../../../../../systems;
+  systemNames = lib.attrNames (lib.filterAttrs 
+    (name: type: type == "directory" && builtins.pathExists (systemsDir + "/${name}/cfg.nix")) 
+    (builtins.readDir systemsDir));
+
+  # Use a helper to check if the attribute path exists safely
+  # This prevents the "attribute 'net' missing" error
+  isValidPeer = p: 
+    (p ? syscfg.net.wg.enable) && 
+    (p.syscfg.net.wg.enable == true) && 
+    (p.syscfg.net.wg.pubkey != config.syscfg.net.wg.pubkey);
+
+  importedConfigs = map (name: import (systemsDir + "/${name}/cfg.nix")) systemNames;
+
+  activePeers = builtins.filter isValidPeer importedConfigs;
+in
+{
   imports = [ ./forwarding.nix ];
   config = lib.mkIf (config.syscfg.net.wg.enable) {
     networking.wireguard = {
@@ -10,18 +27,13 @@
             config.sops.secrets."${config.syscfg.hostname}_wg_priv".path;
           listenPort = 1515;
           mtu = 1340;
-          postSetup = if config.syscfg.net.wg.server.enable then ''
-          for keyfile in /run/secrets/*_wg_pub; do
-            if [ -f "$keyfile" ]; then
-              ${pkgs.wireguard-tools}/bin/wg set wg0 \
-                peer "$(cat "$keyfile")" \
-                allowed-ips 10.10.1.0/24,fd10:10:10::0/64
-            fi
-          done
-          '' else '''';
           peers = 
             if config.syscfg.net.wg.server.enable then
-              []
+              map (p: {
+                name = p.syscfg.hostname;
+                publicKey = p.syscfg.net.wg.pubkey;
+                allowedIPs = [ p.syscfg.net.wg.ip4 p.syscfg.net.wg.ip6 ];
+              }) activePeers
             else
               [{
                 allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];

modules/server/sops/default.nix

@@ -16,5 +16,4 @@
     group = config.users.users.${config.syscfg.defaultUser}.group;
   };
   sops.secrets."${config.syscfg.hostname}_wg_priv" = { };
-  sops.secrets."${config.syscfg.hostname}_wg_pub" = { };
 }

modules/shared/sops/default.nix

@@ -28,12 +28,7 @@ in {
       group = config.users.users.${config.syscfg.defaultUser}.group;
     };
     "${config.syscfg.hostname}_wg_priv" = { };
-    "${config.syscfg.hostname}_wg_pub" = { };
   }
-  (lib.genAttrs 
-    (map (peer: "${peer}_wg_pub") config.syscfg.net.wg.server.peers)
-    (_: { mode = "0444"; })
-  )
   (lib.genAttrs 
     (map (peer: "${peer}_ssh_pub") ["iriy" "avalon" "valinor"])
     (_: { mode = "0444"; })

modules/shared/syscfg/default.nix

@@ -42,6 +42,10 @@ let
         type = types.str;
         default = "";
       };
+      pubkey = mkOption {
+        type = types.str;
+        default = "";
+      };
       server = {
         enable = mkOption {
           type = types.bool;

systems/avalon/cfg.nix

@@ -26,10 +26,13 @@
       cli = true;
       virt = true;
     };
-    wg = {
-      enable = true;
-      ip4 = "10.10.1.2/32";
-      ip6 = "fd10:10:10::2/128";
+    net = {
+      wg = {
+        enable = true;
+        ip4 = "10.10.1.2/32";
+        ip6 = "fd10:10:10::2/128";
+        pubkey = "QlvpTiK6s/lIha9vKmo+teSy2Nw52qWLYatYjxVan3U=";
+      };
     };
   };
 }

systems/gateway/cfg.nix

@@ -22,6 +22,7 @@
         enable = true;
         ip4 = "10.10.1.1/32";
         ip6 = "fd10:10:10::1/128";
+        pubkey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
         server = {
             enable = true;
             peers = ["avalon" "iriy" "valinor"];

systems/gateway/default.nix

@@ -1,6 +1,6 @@
-{ config, inputs, ... }: {
+{ config, lib, inputs, ... }: {
   imports = [ ./hardware.nix ];
-  
+
   services.openssh.enable = true;
   services.openssh.authorizedKeysFiles = [
     config.sops.secrets."iriy_ssh_pub".path

systems/gateway/hardware.nix

@@ -1,7 +1,16 @@
 { config, lib, pkgs, modulesPath, ... }: {
   boot.kernelPackages = pkgs.linuxPackages_latest;
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  boot.loader.grub.device = "/dev/sda";
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/sda";
+    efiSupport = true;
+    efiInstallAsRemovable = true;# CRITICAL: This overwrites /boot/EFI/BOOT/BOOTX64.EFI
+  };
+
   boot.initrd.availableKernelModules =
     [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
   boot.initrd.kernelModules = [ "nvme" ];

systems/iriy/cfg.nix

@@ -30,6 +30,7 @@
         enable = true;
         ip4 = "10.10.1.7/32";
         ip6 = "fd10:10:10::7/128";
+        pubkey = "6d1bINFmH12ACAJLDOwfFIZgmNHV/FGGk0YJyDP50HQ=";
       };
     };
   };

systems/valinor/cfg.nix

@@ -31,6 +31,7 @@
         enable = true;
         ip4 = "10.10.1.5/32";
         ip6 = "fd10:10:10::5/128";
+        pubkey = "EUYd/dMdGcbxiWJXHhQhCXV00cr87pxiW1HExwCTGg0=";
       };
     };
   };