feat(nixos): add neogaia WireGuard client

configs/nixos/modules/network/vpn-client.nix

@@ -0,0 +1,104 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.modules.network.vpn-client;
+in
+{
+  options.modules.network.vpn-client = {
+    enable = lib.mkEnableOption "a WireGuard VPN client";
+
+    interface = lib.mkOption {
+      type = lib.types.str;
+      default = "wg-home";
+      description = "WireGuard interface name.";
+    };
+
+    address = lib.mkOption {
+      type = lib.types.str;
+      example = "10.23.100.3/32";
+      description = "Client tunnel address in CIDR notation.";
+    };
+
+    privateKeySecret = lib.mkOption {
+      type = lib.types.str;
+      default = "wireguard-home-private-key";
+      description = "SOPS secret containing the WireGuard client private key.";
+    };
+
+    autoStart = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Whether to start the VPN tunnel during boot.";
+    };
+
+    mtu = lib.mkOption {
+      type = lib.types.nullOr lib.types.int;
+      default = 1280;
+      description = "Tunnel MTU, or null to use the WireGuard default.";
+    };
+
+    sopsFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = "Encrypted secrets file that contains privateKeySecret.";
+    };
+
+    peer = {
+      publicKey = lib.mkOption {
+        type = lib.types.str;
+        description = "WireGuard public key for the remote peer.";
+      };
+
+      endpoint = lib.mkOption {
+        type = lib.types.str;
+        example = "203.0.113.10:51820";
+        description = "WireGuard endpoint for the remote peer.";
+      };
+
+      allowedIPs = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ "10.23.0.0/16" ];
+        description = "Routes to send through the VPN tunnel.";
+      };
+
+      persistentKeepalive = lib.mkOption {
+        type = lib.types.nullOr lib.types.int;
+        default = 25;
+        description = "Persistent keepalive interval in seconds, or null to disable it.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.sopsFile != null;
+        message = "modules.network.vpn-client.sopsFile must name the encrypted secrets file containing the WireGuard private key.";
+      }
+    ];
+
+    sops.secrets.${cfg.privateKeySecret}.sopsFile = cfg.sopsFile;
+
+    systemd.targets."wireguard-${cfg.interface}" = lib.mkIf (!cfg.autoStart) {
+      wantedBy = lib.mkForce [ ];
+    };
+
+    networking.wireguard.interfaces.${cfg.interface} = {
+      ips = [ cfg.address ];
+      mtu = cfg.mtu;
+      privateKeyFile = config.sops.secrets.${cfg.privateKeySecret}.path;
+
+      peers = [
+        ({
+          inherit (cfg.peer) publicKey endpoint allowedIPs;
+        }
+        // lib.optionalAttrs (cfg.peer.persistentKeepalive != null) {
+          inherit (cfg.peer) persistentKeepalive;
+        })
+      ];
+    };
+  };
+}