wireguard network

connection proxy->v6proxy works
connection mail->v6proxy blocked

hosts/proxy/default.nix

@@ -6,6 +6,12 @@
   ...
 }:
 {
+  sops = {
+    defaultSopsFile = ./secrets.sops.yml;
+    secrets = {
+      "wireguard-key".owner = "systemd-network";
+    };
+  };
   imports = [
     ./hardware-configuration.nix
     ./hetzner-disk.nix
@@ -13,6 +19,7 @@
 
   networking = {
     hostName = "proxy";
+    nameservers = [ "141.56.51.1" ];
     interfaces.ens18.ipv4.addresses = [
       {
         address = "141.56.51.1";
@@ -37,6 +44,30 @@
     nftables = {
       enable = true;
     };
+    wireguard = {
+      enable = true;
+      interfaces = {
+        sturauplink = {
+          privateKeyFile = config.sops.secrets."wireguard-key".path;
+          ips = [
+            "10.100.0.2/24"
+            "fd28:6691:1921:6299::2/64"
+          ];
+          listenPort = 51820;
+          peers = [
+            # mail.test.htw.stura-dresden.de
+            {
+              endpoint = "hetzner.test.htw.stura-dresden.de:51820";
+              allowedIPs = [
+                "10.100.0.0/24"
+              ];
+              persistentKeepalive = 30;
+              publicKey = "Tg/SNniezzF4DUnvUl1/JxQwS18POrUR20UmkQDt+X0=";
+            }
+          ];
+        };
+      };
+    };
   };
 
   # wenn instanzen in die flake migriert sind könnte man das autogenerierien
@@ -255,6 +286,7 @@
               proxy   IN      AAAA    2a01:4f8:1c19:96f8::1
 
               ; Auto-generated CNAME records for all subdomains pointing to proxy
+              hetzner.test IN A 178.104.18.93
               ${lib.foldlAttrs (
                 prev: name: value:
                 let

hosts/proxy/secrets.sops.yml

@@ -0,0 +1,25 @@
+wireguard-key: ENC[AES256_GCM,data:tEKd+iwfyabTj/spqh08Um3FX4grLeffTxCvBivkXrNqIzOymBdcgQL4IJ4=,iv:Z2sr5yzxTKXgBgfcd3LWB9jT2fX3uRpX07r4yMplSNY=,tag:IWgiEjjbHbIUORhwKjTM6g==,type:str]
+sops:
+    age:
+        - recipient: age1g9fnxzalnqtse29xjdrvcsrnrknp8t2s7xrle73fce0jcg7r3czsj524p4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXcUhhSlVQcHgvUEtDa0E2
+            UU1ON3NiUUlHTXFUOEdNeUdGVWNVTWRRNW0wCmhTVnJONlZSMmt2OVJiMys5bnM2
+            TDZPMExYaWlKSVFPVERnS1QvVTJlNXMKLS0tIElTYmxHNTFPSmNXYnkrY2RtRUVL
+            WHBCYWhtSWt1QW9hbEFwVmdqWUxjUmMKpqfV/bJVfyDI2Wa+jlwsXMx3tNV9G0S2
+            VhmmpDnEJn6UDWAMYxNv0g3rtfhBkb2HyCtANNVQ7QROua9WHzJjlg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1qp7w80k3qtj79xsl0gwsfrkm037xrlnhm6th7tcyrvufh3szzp6s2pe7ra
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVVUVkdDljcForNEJ2WmNm
+            N0QvTWhQWXQ1VHh5b0pCZFQ3aGxXSGY2bXprCmpEV2l6bkxnUDByNVZaVVR6N2lE
+            OG1sYkJrQmFVWW1vWXRZL1A2S29MejQKLS0tIEFKbkRmdWM0QW9vVlJWZElXSUcw
+            b1pCMjNIN1padE5JNVpZNFYwMnZGd00KM415cr6nuN6zfhDcfXFN2lMDWogLwDSE
+            Kq/ykUSuN9IU6AhslgBNRCmJRVHIzCmu5dU5NVZeqN1YT/EyAbEcyw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-21T18:56:03Z"
+    mac: ENC[AES256_GCM,data:v1RkpxjvgLHS3OOA2aEG+uJ3yWpOvJLwFA5jRBRtMoMvrBD8O8sikzWJUczQnpw85F/ieFqK6RdT8SBA9lIuPXYMRRS8icHI2a8P+zwySsWsnzc9UaJjjvKtkYo9nnPNCM36HAFOKHiAzBm7FWMt1Tl+WQMyVCWLXCN7ao0MjIo=,iv:8xCrY7QOhW5Mc/AWWXFocqwTUD9qvH4dLYYtnsU6PHw=,tag:09Nw7qFfjefrv0jBwaFINA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.1