Made a post about this on reddit as well, but was curious if there was some more input to be found here. So i’m in the process of writing a guix config for my server and as i was going through the wireguard module, when it comes to the endpoint it gives an example of just passing it a string, but my endpoint is my public ip, and i obviously don’t want that to be part of my version control. So i was wondering if someone here has a similar setup and has a good solution for this? I was wondering if i could just use something like local-file perhaps and point it to a file outside of version control, or point it to a file in /etc similar to what is done with the private-key field in the documentation.
Maybe a lookup of your public IP at runtime or system reconfigure time?
But why not include machine specific values in your Guix config?
If it’s because you public the config to a public repo, then you could put it in a include and put the included file into a .gitignore?
Yeah it’s because i store my config in a public repo. .gitignore could also be an option. I’m thinking of maybe managing it through pass, assuming that’ll work, since the documentation has an example of doing that for the private-key as well.
I have same thing in my TODO and I’m currently weighting pros and cons between two ways:
- gopass
- SOPS
Gopass instead of pass simply because it can synchronize between my machines and I’m quite used to it. For me, main benefit of gopass is that I’m already using it. Cons are two - information’s are stored in different place than my code. And storing different data then passwords seems weird. But you can bend it this way without anyproblem, even attach other yaml formatted keys to “passwords”.
SOPS because it is nice to have all data relevant to your configuration commited alongside your changes. There is even GitHub - fishinthecalculator/sops-guix: Secure secret provisioning with Guix and SOPS · GitHub to help you.
Just wanted to write an update here. So after brushing up on wireguard a little it seems like i have been an idiot this whole time and realized i don’t need to configure the endpoint on my server at all, only on the client side. However on my current system on the server side the endpoint for the peers was written automatically to the conf file, which is what got me confused. As for the private-key, i settled on just pointing it to a file in /etc/wireguard, like described in the documentation. Since i don’t have any other secrets to manage atm, something like sops-guix feels like overkill for me and adds unnecessary reliance on another channel (imo). It would still be nice to declaritively configure the endpoint on my client machines, but honestly i’m fine with settling with just adding it imperatively to networkmanager, or just creating a shepherd service that activates the interface with wg-quick or something like that. I tried setting the endpoint similar to how guix does it with the private-key by adding a postUp entry that sets the endpoint by reading it from a file, but the endpoint option does not accept a file to read from as an argument, unlike the private-key according to the wg man page, So it seems like what i wanted to do is not possible in that sense. But i consider the issue solved now.