Commit 71a5571a6636

Vincent Demeester <vincent@sbr.pm>
2026-06-10 11:47:41
fix(aomi): update WireGuard pubkey and read private key from file
Updated aomi VPN pubkey after Fedora CSB reinstall. Changed wg0.conf to use PostUp with wg set to read private key from /etc/wireguard/ private.key at runtime instead of inlining a placeholder in the nix store.
main
1 parent f8a1b72
Changed files (2)
systems
aomi
system.nix
globals.nix
systems/aomi/system.nix
@@ -41,10 +41,12 @@ in
 
     # WireGuard configuration file
     # NOTE: Private key must be added manually to /etc/wireguard/private.key
+    # WireGuard configuration file
+    # Private key is read from /etc/wireguard/private.key (not in nix store)
     environment.etc."wireguard/wg0.conf" = {
       text = ''
         [Interface]
-        PrivateKey = PLACEHOLDER_REPLACE_MANUALLY
+        PostUp = wg set %i private-key /etc/wireguard/private.key
         Address = ${builtins.head machine.net.vpn.ips}/24
 
         [Peer]
@@ -53,7 +55,7 @@ in
         Endpoint = ${globals.net.vpn.endpoint}:51820
         PersistentKeepalive = 25
       '';
-      mode = "0600";
+      mode = "0644";
     };
 
     # Syncthing user service for vincent
globals.nix
@@ -274,7 +274,7 @@ _: {
       net = {
         ips = [ "192.168.1.23" ];
         vpn = {
-          pubkey = "XT4D9YLeVHwMb9R4mhBLSWHYF8iBO/UOT86MQL1jnA4=";
+          pubkey = "Pmu/0CjRaClmz+v25OV3SLd/V6Il8YLLavbtu8cYSGY=";
           ips = [ "10.100.0.17" ];
         };
         names = [