Commit 0897bf5e80a7

@@ -150,12 +150,6 @@ in
       };
     };
 
-    wireguard = {
-      enable = true;
-      ips = libx.wg-ips globals.machines.aion.net.vpn.ips;
-      endpoint = "${globals.net.vpn.endpoint}";
-      endpointPublicKey = "${globals.machines.kerkouane.net.vpn.pubkey}";
-    };
 
     audible-sync = {
       enable = true; # enable one migration dayrs

@@ -98,12 +98,6 @@ in
         };
     };
 
-    wireguard = {
-      enable = true;
-      ips = libx.wg-ips globals.machines.aix.net.vpn.ips;
-      endpoint = "${globals.net.vpn.endpoint}";
-      endpointPublicKey = "${globals.machines.kerkouane.net.vpn.pubkey}";
-    };
 
     # DNS resolver for local network - resolve specific sbr.pm domains to Aix
     dnsmasq = {

@@ -37,12 +37,6 @@
       HandleLidSwitchExternalPower = "ignore";
       HandleLidSwitchDocked = "ignore";
     };
-    wireguard = {
-      enable = true;
-      ips = libx.wg-ips globals.machines.aomi.net.vpn.ips;
-      endpoint = "${globals.net.vpn.endpoint}";
-      endpointPublicKey = "${globals.machines.kerkouane.net.vpn.pubkey}";
-    };
 
     smartd = {
       enable = true;

@@ -20,12 +20,4 @@
     group = "users";
   };
 
-  services = {
-    wireguard = {
-      enable = true;
-      ips = libx.wg-ips globals.machines.athena.net.vpn.ips;
-      endpoint = "${globals.net.vpn.endpoint}";
-      endpointPublicKey = "${globals.machines.kerkouane.net.vpn.pubkey}";
-    };
-  };
 }

@@ -19,6 +19,7 @@
     ../services/avahi.nix
     ../services/openssh.nix
     ../services/prometheus-exporters-node.nix
+    ../services/wireguard.nix
     ../programs/age.nix
     # ../services/wireguard.nix # or netbird
   ];

@@ -0,0 +1,24 @@
+# Auto-derive WireGuard client config from hostname + globals.
+# Kerkouane (the VPN server) is excluded — it keeps its own server config.
+{
+  hostname,
+  globals,
+  libx,
+  lib,
+  ...
+}:
+let
+  machine = globals.machines.${hostname};
+  isServer = hostname == "kerkouane";
+  hasVpn = machine ? net && machine.net ? vpn;
+in
+{
+  config = lib.mkIf (hasVpn && !isServer) {
+    services.wireguard = {
+      enable = true;
+      ips = libx.wg-ips machine.net.vpn.ips;
+      endpoint = globals.net.vpn.endpoint;
+      endpointPublicKey = globals.machines.kerkouane.net.vpn.pubkey;
+    };
+  };
+}

@@ -48,12 +48,7 @@
     #   logLevel = "INFO";
     # };
 
-    wireguard = {
-      enable = true;
-      ips = libx.wg-ips globals.machines.demeter.net.vpn.ips;
-      endpoint = "${globals.net.vpn.endpoint}";
-      endpointPublicKey = "${globals.machines.kerkouane.net.vpn.pubkey}";
-    };
+
   };
 
   age.secrets."mosquitto-homeassistant-password" = {

@@ -69,12 +69,7 @@
       enable = true;
       pruneBindMounts = true;
     };
-    wireguard = {
-      enable = true;
-      ips = libx.wg-ips globals.machines.kyushu.net.vpn.ips;
-      endpoint = "${globals.net.vpn.endpoint}";
-      endpointPublicKey = "${globals.machines.kerkouane.net.vpn.pubkey}";
-    };
+
     hardware.bolt.enable = true;
     printing = {
       enable = true;

@@ -68,13 +68,6 @@
     keyboards = [ "Eyelash Corne" ];
   };
 
-  # Wireguard VPN
-  services.wireguard = {
-    enable = true;
-    ips = libx.wg-ips globals.machines.okinawa.net.vpn.ips;
-    endpoint = "${globals.net.vpn.endpoint}";
-    endpointPublicKey = "${globals.machines.kerkouane.net.vpn.pubkey}";
-  };
 
   # Age secrets
   age.secrets = {

@@ -429,12 +429,7 @@ in
         };
     };
 
-    wireguard = {
-      enable = true;
-      ips = libx.wg-ips globals.machines.rhea.net.vpn.ips;
-      endpoint = "${globals.net.vpn.endpoint}";
-      endpointPublicKey = "${globals.machines.kerkouane.net.vpn.pubkey}";
-    };
+
     # smartd = {
     #   enable = true;
     #   devices = [ { device = "/dev/nvme0n1"; } ];

@@ -459,12 +459,7 @@ in
       '';
     };
 
-    wireguard = {
-      enable = true;
-      ips = libx.wg-ips globals.machines.sakhalin.net.vpn.ips;
-      endpoint = "${globals.net.vpn.endpoint}";
-      endpointPublicKey = "${globals.machines.kerkouane.net.vpn.pubkey}";
-    };
+
   };
 
   # Create Grafana dashboard directory and deploy Ollama dashboards

@@ -24,12 +24,7 @@
   ];
 
   services = {
-    wireguard = {
-      enable = true;
-      ips = libx.wg-ips globals.machines.shikoku.net.vpn.ips;
-      endpoint = "${globals.net.vpn.endpoint}";
-      endpointPublicKey = "${globals.machines.kerkouane.net.vpn.pubkey}";
-    };
+
     aria2 = {
       enable = true;
       openPorts = true;