updating network to networkd

hosts/quitte/configuration.nix

@@ -4,6 +4,7 @@
   imports =
     [
       ./hardware-configuration.nix
+      ./network.nix
     ];
 
   # Use the systemd-boot EFI boot loader.
@@ -12,20 +13,6 @@
   boot.loader.efi.canTouchEfiVariables = true;
   boot.supportedFilesystems = [ "zfs" ];
   boot.zfs.devNodes = "/dev/";
-  networking.hostId = "a41d87fc";
-
-  networking.interfaces.enp65s0f0np0 = {
-    useDHCP = false;
-    ipv4.addresses = [
-      {
-        address = "141.30.30.169";
-        prefixLength = 25;
-      }
-    ];
-  };
-
-  networking.defaultGateway = "141.30.30.129";
-  networking.nameservers = [ "141.30.1.1" ];
 
   networking.hostName = "quitte"; # Define your hostname.
 

hosts/quitte/network.nix

@@ -0,0 +1,81 @@
+{ pkgs, config, lib, ... }:
+let
+  wireguard_port = 51820;
+in
+{
+  sops.secrets = {
+    "wg-fsr" = {
+      owner = config.users.users.systemd-network.name;
+    };
+  };
+
+  networking = {
+    hostId = "a71c81fc";
+    enableIPv6 = true;
+    useDHCP = true;
+    interfaces.enp65s0f0np0.useDHCP = true;
+    useNetworkd = true;
+
+    firewall.allowedUDPPorts = [ wireguard_port ];
+    wireguard.enable = true;
+  };
+
+  services.resolved = {
+    enable = true;
+    dnssec = "false";
+    fallbackDns = [ "1.1.1.1" ];
+  };
+
+  # workaround for networkd waiting for shit
+  systemd.services.systemd-networkd-wait-online.serviceConfig.ExecStart = [
+    "" # clear old command
+    "${config.systemd.package}/lib/systemd/systemd-networkd-wait-online --any"
+  ];
+
+  systemd.network = {
+    enable = true;
+
+    # Interfaces on the machine
+    networks."10-ether-bond" = {
+      matchConfig.Name = "enp65s0f0np0";
+      networkConfig = {
+        Address = "141.30.30.169/25";
+        Gateway = "141.30.30.129";
+        DNS = "141.30.1.1";
+        #IPv6AcceptRA = true;
+      };
+    };
+
+    # defining network device for wireguard connections
+    netdevs."fsr-wg" = {
+      netdevConfig = {
+        Kind = "wireguard";
+        Name = "fsr-wg";
+        Description = "fsr enterprise wireguard";
+      };
+      wireguardConfig = {
+        PrivateKeyFile = config.sops.secrets."wg-fsr".path;
+        ListenPort = wireguard_port;
+      };
+      wireguardPeers = [
+        {
+          # tassilo
+          wireguardPeerConfig = {
+            PublicKey = "vgo3le9xrFsIbbDZsAhQZpIlX+TuWjfEyUcwkoqUl2Y=";
+            AllowedIPs = [ "10.66.66.100/32" ];
+            PersistentKeepalive = 25;
+          };
+        }
+      ];
+    };
+
+    # fsr wireguard server
+    networks."fsr-wg" = {
+      matchConfig.Name = "fsr-wg";
+      networkConfig = {
+        Address = "10.66.66.1/24";
+        IPForward = "ipv4";
+      };
+    };
+  };
+}