From 45d23c58756b353fc75c17e4e22603ff2fa0e04b Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Tue, 14 Jul 2026 12:24:33 +0400
Subject: [PATCH] wireguard: wg0/wg2 configs from sops

---
 modules/wireguard.nix | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/modules/wireguard.nix b/modules/wireguard.nix
index a676869..580cbf4 100644
--- a/modules/wireguard.nix
+++ b/modules/wireguard.nix
@@ -6,14 +6,27 @@
     wireguard-tools
   ];
 
+  sops.secrets = {
+    "wg0.conf" = {
+      sopsFile = "/etc/nixos/secrets/wg0.conf";
+      format = "binary";
+      restartUnits = [ "wg-quick-wg0.service" ];
+    };
+    "wg2.conf" = {
+      sopsFile = "/etc/nixos/secrets/wg2.conf";
+      format = "binary";
+      restartUnits = [ "wg-quick-wg2.service" ];
+    };
+  };
+
   # WireGuard interface
   networking.wg-quick.interfaces = {
     wg0 = {
-      configFile = "/etc/wireguard/wg0.conf"; # TODO: Secret Manager. TODO: Add SSH, GPG as well to secret manager
+      configFile = config.sops.secrets."wg0.conf".path;
       autostart = true;
     };
     wg2 = {
-      configFile = "/etc/wireguard/wg2.conf";
+      configFile = config.sops.secrets."wg2.conf".path;
       autostart = true;
     };
   };