wireguard network

connection proxy->v6proxy works
connection mail->v6proxy blocked

hosts/v6proxy/default.nix

@@ -6,6 +6,12 @@
   ...
 }:
 {
+  sops = {
+    defaultSopsFile = ./secrets.sops.yml;
+    secrets = {
+      "wireguard-key".owner = "systemd-network";
+    };
+  };
   imports = [
     ./hardware-configuration.nix
     ./hetzner-disk.nix
@@ -48,6 +54,37 @@
     nftables = {
       enable = true;
     };
+    wireguard = {
+      enable = true;
+      interfaces = {
+        sturauplink = {
+          listenPort = 51820;
+          privateKeyFile = config.sops.secrets."wireguard-key".path;
+          ips = [
+            "10.100.0.1/24"
+            "fd28:6691:1921:6299::1/64"
+          ];
+          peers = [
+            # mail.test.htw.stura-dresden.de
+            {
+              allowedIPs = [
+                "10.100.0.20/32"
+              ];
+              publicKey = "9Ep/YZLbnGEVWHgVmmwq2Sv/8awwGaHdwiSuIUkWtnk=";
+            }
+            # proxy.htw.stura-dresden.de
+            {
+              allowedIPs = [
+                "10.100.0.2/32"
+                "fd28:6691:1921:6299::2/64"
+              ];
+              endpoint = "141.56.51.1:51820";
+              publicKey = "pUHtAHCDHVQBnqtlIgTkEMHbxXpQmVA0HhxiFUrUb0U=";
+            }
+          ];
+        };
+      };
+    };
   };
 
   # wenn instanzen in die flake migriert sind könnte man das autogenerierien
@@ -102,6 +139,7 @@
     };
 
   environment.systemPackages = with pkgs; [
+    wireguard-tools
   ];
 
   system.stateVersion = "25.11";

hosts/v6proxy/secrets.sops.yml

@@ -0,0 +1,25 @@
+wireguard-key: ENC[AES256_GCM,data:K3UoCWtF2rL8uCzmu8yn4sHKHOrcKmnNBvRQdC9Ph3fWMdDqNqh0jwSByjQ=,iv:feFxNykRK1RJ6EPPVXqXtEVmXeGez4PwJ9h7m1KYUIE=,tag:hSTf/gAUVSjI1GburqRDVA==,type:str]
+sops:
+    age:
+        - recipient: age1gl8zmw86jkrkr7kaqugdyhvdhdrnfd72smndz2kfh4a6ec6s9yxsyrecu6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsbVd3OUNCMUI3eUI2QlVa
+            WFNjVUpXYVlLdUxiSzhQdHhhRWRpWEhzV1IwCkdYMG5DOXBxTnMwNFpYM1FweDNp
+            ZXd2aXJaNWxOYXRnaW1nSjdNQVpQOU0KLS0tIEY4Q1JqV1FSekVwc0prNjRCUDdm
+            cmpLdW1abFR5SlhxZnpJdnBlNjJQOGMK+JcLyiSCfhVPnhqpqTzB7flFWTff3GcK
+            9779AvKVnhsDb5LDPOi4Ah5gAJfq+JZ/+IiTUqk0a4AWuN9PiyTMGA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1qp7w80k3qtj79xsl0gwsfrkm037xrlnhm6th7tcyrvufh3szzp6s2pe7ra
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBncnVRVi91OWsxejJiS0Y0
+            L2licWRJQ1pGTlZOMEM0VHdyOWlFbEgyRENVCmwxSndQamRZM2NKbW14TTI4aFBV
+            MHQ3YkJwNUhkWlJNSTB2RFBpZEswT28KLS0tIC9EVUxvYk04ek5xc1d4TXl5RFVD
+            MkFyQkxCWDdWQjUxQ0QwcjlScGxPWWMKtzYvXoSSPGhVFlwzdtZylu3eTE5EKxqO
+            OIq9IOOujV3K1dzj5uwmCI+EoEasOMLy7Sa4++1WZmRVmVxFa91/gw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-21T17:41:20Z"
+    mac: ENC[AES256_GCM,data:f94ubkkhUDMkvEPEYYGVg1mahaMmXqAdMcF9Vl16jj7FQTvJy9GCg+1F7eBOu0endpcTQo2a/apd2u7tnzA0IE3CfXo2U8d8aun6yTxxn9qopnxypP2v6mGDHsGbaUI3r+/ZgLXtGDDN+gS/zyu06CPFq/TdLnmcO9zuXAeBmWc=,iv:5VEsRV20A56FKNRQlgojY5TQLhW+kgotQBPgElZY+uQ=,tag:K13Owxl3MDwf5n9soXxiXA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.1