Waybar here i come (#58)

2026-08-23 03:25:47 +02:00 · 2026-08-13 13:55:30 +02:00
parent f1f22de7b7
commit 0cef4320fd
137 changed files with 3488 additions and 2941 deletions
@@ -0,0 +1,78 @@
+{
+  config,
+  pkgs,
+  ...
+}: let
+  vpnConnection = "wg-vpn";
+
+  # Same OSD mechanism as home/system/waybar/scripts.nix's waybar-osd: drop the
+  # text in /tmp/waybar-osd and nudge waybar's custom/osd module to show it.
+  toggleVpn = pkgs.writeShellScript "toggle-wg-vpn" ''
+    set -euo pipefail
+    nmcli="${pkgs.networkmanager}/bin/nmcli"
+
+    if "$nmcli" -t -f NAME connection show --active | grep -qx "${vpnConnection}"; then
+      "$nmcli" connection down "${vpnConnection}"
+      OSD_TEXT="󰦝  VPN Off"
+    else
+      "$nmcli" connection up "${vpnConnection}"
+      OSD_TEXT="󰦝  VPN On"
+    fi
+
+    printf '%s' "$OSD_TEXT" > /tmp/waybar-osd
+    ${pkgs.procps}/bin/pkill -x -RTMIN+8 waybar 2>/dev/null || true
+  '';
+in {
+  environment.systemPackages = [
+    (pkgs.makeDesktopItem {
+      name = "toggle-wg-vpn";
+      desktopName = "Toggle VPN";
+      comment = "Turn the WireGuard VPN connection on or off";
+      icon = "network-vpn-symbolic";
+      exec = "${toggleVpn}";
+      terminal = false;
+      categories = ["Network"];
+    })
+  ];
+
+  sops = {
+    age.keyFile = "/home/hadi/.config/sops/age/keys.txt";
+    defaultSopsFile = ./secrets/secrets.yaml;
+    secrets.wireguard-private-key = {};
+
+    templates."wg-vpn.nmconnection" = {
+      path = "/etc/NetworkManager/system-connections/wg-vpn.nmconnection";
+      mode = "0600";
+      owner = "root";
+      group = "root";
+      content = ''
+        [connection]
+        id=wg-vpn
+        type=wireguard
+        interface-name=wg-vpn
+        autoconnect=true
+        autoconnect-priority=0
+
+        [wireguard]
+        private-key=${config.sops.placeholder.wireguard-private-key}
+
+        [wireguard-peer.36G8+pInNcPK9F1TpHglWs9Pk5uJOY9o8SCNrCBgvHE=]
+        endpoint=89.222.96.158:51820
+        allowed-ips=0.0.0.0/0;::/0;
+        persistent-keepalive=25
+
+        [ipv4]
+        method=manual
+        address1=10.2.0.2/32
+        dns=10.2.0.1;
+
+        [ipv6]
+        method=manual
+        address1=2a07:b944::2:2/128
+        dns=2a07:b944::2:1;
+        addr-gen-mode=default
+        ip6-privacy=0
+      '';
+    };
+  };
+}