Commit 0078c0f1418c

@@ -221,9 +221,16 @@ setup_home_manager() {
 
 # --- Phase 6: WireGuard key ---
 
-setup_wireguard_key() {
+setup_wireguard() {
+	# Use Fedora-native wg-quick service (proper SELinux context)
+	# Config file is managed by system-manager in /etc/wireguard/wg0.conf
+	log_info "Setting up WireGuard (native service)..."
+	sudo dnf install -y wireguard-tools
+	sudo systemctl enable wg-quick@wg0
+
 	if [[ -f /etc/wireguard/private.key ]]; then
-		log_info "WireGuard private key already exists"
+		log_info "WireGuard private key exists, starting service..."
+		sudo systemctl start wg-quick@wg0
 		return 0
 	fi
 
@@ -235,7 +242,7 @@ setup_wireguard_key() {
 	log_warn "     Then update globals.nix with new pubkey: sudo cat /etc/wireguard/private.key | wg pubkey"
 	log_warn ""
 	log_warn "After placing the key:  sudo chmod 600 /etc/wireguard/private.key"
-	log_warn "Then re-run:  sudo systemctl restart wireguard-wg0"
+	log_warn "Then re-run:  sudo systemctl restart wg-quick@wg0"
 }
 
 print_summary() {
@@ -272,7 +279,7 @@ main() {
 	build_and_activate
 	install_native_apps
 	setup_home_manager
-	setup_wireguard_key
+	setup_wireguard
 	print_summary
 }
 

@@ -25,24 +25,11 @@ in
       git
     ];
 
-    # WireGuard wg0 service
-    systemd.services.wireguard-wg0 = {
-      description = "WireGuard VPN (wg0)";
-      wants = [ "network-online.target" ];
-      after = [ "network-online.target" ];
-      wantedBy = [ "system-manager.target" ];
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-        ExecStart = "${pkgs.wireguard-tools}/bin/wg-quick up wg0";
-        ExecStop = "${pkgs.wireguard-tools}/bin/wg-quick down wg0";
-      };
-    };
-
-    # WireGuard configuration file
-    # NOTE: Private key must be added manually to /etc/wireguard/private.key
-    # WireGuard configuration file
-    # Private key is read from /etc/wireguard/private.key (not in nix store)
+    # WireGuard: config managed by system-manager, service by Fedora native wg-quick@wg0
+    # Nix-store binaries lack proper SELinux context for network admin ops,
+    # so we use Fedora's wg-quick which runs with the correct domain.
+    # Enable with: sudo dnf install wireguard-tools && sudo systemctl enable --now wg-quick@wg0
+    # Private key is read at runtime from /etc/wireguard/private.key
     environment.etc."wireguard/wg0.conf" = {
       text = ''
         [Interface]