feat(nixos): add neogaia WireGuard client

configs/nixos/hosts/neogaia/default.nix

@@ -33,6 +33,23 @@
 
   registry.address.neogaia.self = "10.23.50.146";
 
+  modules.network.vpn-client = {
+    enable = true;
+    sopsFile = ../../secrets/neogaia.yaml;
+    address = "10.23.100.3/32";
+
+    peer = {
+      publicKey = "sGEkSD+gEdIMXi4PBN3AhwHGc4tWMtcjOIey3s7yb3I=";
+      endpoint = "100.0.90.192:51820";
+      allowedIPs = [ "10.23.0.0/16" ];
+    };
+  };
+
+  registry.shell-shortcut.neogaia = {
+    vpn-on = "sudo systemctl start wireguard-wg-home.target";
+    vpn-off = ''sudo systemctl stop 'wireguard-wg-home*.service' wireguard-wg-home.target'';
+  };
+
   # So setup can be driven over the network.
   # The matching host public keys sit beside this file in plaintext, since
   # publishing them is their purpose.