machine_setup/nix/configuration/roles/wireguard/default.nix

{
  config,
  lib,
  pkgs,
  ...
}:
let
  activatedWg = name: {
    networking.wg-quick.interfaces."${name}".configFile = "/persist/manual/wireguard/${name}.conf";
    systemd.services."wg-quick-${name}" = {
      after = [
        "nss-lookup.target"
        "systemd-resolved.service"
        "multi-user.target"
      ];
      preStart = "${pkgs.toybox}/bin/sleep 10";
    };
    # systemd.services."wg-quick-${name}".after = [
    #   "nss-lookup.target"
    #   "systemd-resolved.service"
    #   "multi-user.target"
    # ];
    # systemd.services."wg-quick-${name}".preStart = "${pkgs.toybox}/bin/sleep 10";
  };
  deactivatedWg = name: {
    networking.wg-quick.interfaces."${name}" = {
      configFile = "/persist/manual/wireguard/${name}.conf";
      autostart = false;
    };
  };
  wireguard_enable = (config.me.wireguard.activated != [ ] || config.me.wireguard.deactivated != [ ]);
in
{
  imports = [ ];

  options.me = {
    wireguard.activated = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      default = false;
      example = true;
      description = "List of wireguard config names that should be activated at boot.";
    };
    wireguard.deactivated = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      default = false;
      example = true;
      description = "List of wireguard config names that are not activated at boot but can be manually activated later.";
    };
  };

  config = lib.mkIf wireguard_enable (
    lib.mkMerge [
      {
        networking.firewall.allowedUDPPorts = [ 51821 ];
        networking.wireguard.enable = true;
      }
      (activatedWg "drmario")
      (activatedWg "wgh")
      (activatedWg "colo")
      (deactivatedWg "wgf")
    ]
  );
}