machine_setup/nix/configuration/roles/wireguard/default.nix

{
  config,
  lib,
  pkgs,
  ...
}:

{
  imports = [ ];

  config = lib.mkIf (!config.me.buildingIso) {
    networking.firewall.allowedUDPPorts = [ 51821 ];
    networking.wireguard.enable = true;
    networking.wg-quick.interfaces.drmario.configFile = "/persist/manual/wireguard/drmario.conf";
    systemd.services."wg-quick-drmario".after = [
      "nss-lookup.target"
      "systemd-resolved.service"
      "multi-user.target"
    ];

    systemd.services."wg-quick-drmario".preStart = "${pkgs.toybox}/bin/sleep 10";

    networking.wg-quick.interfaces.wgh.configFile = "/persist/manual/wireguard/wgh.conf";
    systemd.services."wg-quick-wgh".after = [
      "nss-lookup.target"
      "systemd-resolved.service"
      "multi-user.target"
    ];

    systemd.services."wg-quick-wgh".preStart = "${pkgs.toybox}/bin/sleep 10";
  };

  # environment.systemPackages = with pkgs; [
  #   wireguard-tools
  # ];

}