# Sol-style client pool for personal mesh.
# Backbone peers use wg-mesh; phones/laptops use this separate interface.
{ config, pkgs, ... }:
{
  environment.systemPackages = [ pkgs.wireguard-tools ];

  networking.wireguard.interfaces.wg-clients1 = {
    ips = [ "10.0.1.1/24" ];
    listenPort = 51821;
    privateKeyFile = "/var/lib/wireguard/wg-clients1.key";
    allowedIPsAsRoutes = false;
    peers = [
      {
        # lilac (Pixel 9 Pro), generated on poppy; private key is not in git.
        publicKey = "RAvcRTdFBcvAGZWRm6YBMjRHRGj0iMNxsE0MBPGUPjM=";
        allowedIPs = [ "10.0.1.10/32" ];
      }
    ];
  };

  networking.firewall.allowedUDPPorts = [ 51821 ];

  systemd.tmpfiles.rules = [
    "d /var/lib/wireguard 0700 root root -"
  ];

  # Generate the server key on first activation, outside the Nix store.
  systemd.services.wireguard-key-wg-clients1 = {
    description = "Generate wg-clients1 private key if absent";
    wantedBy = [ "wireguard-wg-clients1.service" ];
    before = [ "wireguard-wg-clients1.service" ];
    serviceConfig.Type = "oneshot";
    script = ''
      install -d -m 700 /var/lib/wireguard
      if [ ! -s /var/lib/wireguard/wg-clients1.key ]; then
        umask 077
        ${pkgs.wireguard-tools}/bin/wg genkey > /var/lib/wireguard/wg-clients1.key
        chmod 600 /var/lib/wireguard/wg-clients1.key
      fi
    '';
  };
}