From c2affc7e3c729c141495b4885dc9dd76cd5fbcd3 Mon Sep 17 00:00:00 2001
From: Luna Heyman <contact@luna.fish>
Date: Sat, 18 Jul 2026 18:54:25 +0200
Subject: [PATCH] feat(hosts/tsubaki): add protonvpn

---
 nix/hosts/blackstar/configuration.nix         |  6 ++--
 nix/hosts/tsubaki/configuration.nix           | 28 +++++++++++++++++--
 nix/secrets/secrets.nix                       |  9 +++++-
 nix/secrets/tsubaki/protonvpn/private-key.age |  8 ++++++
 4 files changed, 45 insertions(+), 6 deletions(-)
 create mode 100644 nix/secrets/tsubaki/protonvpn/private-key.age

diff --git a/nix/hosts/blackstar/configuration.nix b/nix/hosts/blackstar/configuration.nix
index 0b07692..56a4014 100644
--- a/nix/hosts/blackstar/configuration.nix
+++ b/nix/hosts/blackstar/configuration.nix
@@ -38,15 +38,15 @@
   ];
 
   networking.firewall.allowedUDPPorts = [
-    config.networking.wireguard.interfaces.wg0.listenPort
+    config.networking.wg-quick.interfaces.wg0.listenPort
   ];
 
   age.secrets = {
     "wireguard/private-key".file = "${self}/nix/secrets/blackstar/wireguard/private-key.age";
   };
 
-  networking.wireguard.interfaces.wg0 = {
-    ips = [ "10.0.0.1/24" ];
+  networking.wg-quick.interfaces.wg0 = {
+    address = [ "10.0.0.1/24" ];
     listenPort = 51820;
     privateKeyFile = config.age.secrets."wireguard/private-key".path;
 
diff --git a/nix/hosts/tsubaki/configuration.nix b/nix/hosts/tsubaki/configuration.nix
index fb5dc5c..72aa6c1 100644
--- a/nix/hosts/tsubaki/configuration.nix
+++ b/nix/hosts/tsubaki/configuration.nix
@@ -36,10 +36,17 @@
 
   age.secrets = {
     "wireguard/private-key".file = "${self}/nix/secrets/tsubaki/wireguard/private-key.age";
+    "protonvpn/private-key".file = "${self}/nix/secrets/tsubaki/protonvpn/private-key.age";
   };
 
-  networking.wireguard.interfaces.wg0 = {
-    ips = [ "10.0.0.2/24" ];
+  networking.interfaces.enp1s0.ipv4.routes = lib.singleton {
+    address = "162.19.246.218";
+    prefixLength = 32;
+    via = "192.168.0.1";
+  };
+
+  networking.wg-quick.interfaces.wg0 = {
+    address = [ "10.0.0.2/24" ];
     privateKeyFile = config.age.secrets."wireguard/private-key".path;
 
     peers = lib.singleton {
@@ -50,6 +57,23 @@
     };
   };
 
+  networking.wg-quick.interfaces.protonvpn = {
+    address = [ "10.2.0.2/32" ];
+    dns = [ "10.2.0.1" ];
+    privateKeyFile = config.age.secrets."protonvpn/private-key".path;
+
+    peers = lib.singleton {
+      publicKey = "bb/CPM+G5wt6VrDIdisuxrUNEqfH5hPxVw/+pYAOcWw=";
+      endpoint = "79.127.160.187:51820";
+      persistentKeepalive = 25;
+
+      allowedIPs = [
+        "0.0.0.0/0"
+        "::/0"
+      ];
+    };
+  };
+
   services.jellyfin = {
     enable = true;
     openFirewall = true;
diff --git a/nix/secrets/secrets.nix b/nix/secrets/secrets.nix
index 0cfe62b..772cfa5 100644
--- a/nix/secrets/secrets.nix
+++ b/nix/secrets/secrets.nix
@@ -2,6 +2,7 @@ let
   keys = import ./keys.nix;
 in
 {
+  # keep-sorted start block=yes newline_separated=yes
   "blackstar/passwords/luna.age".publicKeys = [
     keys.blackstar.root
     keys.blackstar.luna
@@ -27,12 +28,17 @@ in
     keys.crona.luna
   ];
 
+  "tsubaki/passwords/luna.age".publicKeys = [
+    keys.tsubaki.root
+    keys.tsubaki.luna
+  ];
+
   "tsubaki/passwords/root.age".publicKeys = [
     keys.tsubaki.root
     keys.tsubaki.luna
   ];
 
-  "tsubaki/passwords/luna.age".publicKeys = [
+  "tsubaki/protonvpn/private-key.age".publicKeys = [
     keys.tsubaki.root
     keys.tsubaki.luna
   ];
@@ -41,4 +47,5 @@ in
     keys.tsubaki.root
     keys.tsubaki.luna
   ];
+  # keep-sorted end
 }
diff --git a/nix/secrets/tsubaki/protonvpn/private-key.age b/nix/secrets/tsubaki/protonvpn/private-key.age
new file mode 100644
index 0000000..8f38bcf
--- /dev/null
+++ b/nix/secrets/tsubaki/protonvpn/private-key.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 xRe9Sw u4zySs3hSgaZrBM1iWvtEXPJZyLkqbSKNNCtUf4c7hI
+g4x63BDZO6obrravrgPj/u3EIvhqtBZfSYTFJ1XkLEo
+-> ssh-ed25519 ufWL0A XE++QO4DtslbQwjKybKLUiP3bYs9mCpLYmyi4MQ/lVg
+zInhoLMSTvapTn59A16jd7+IMVCYazWWgL3cOvi3c0E
+--- HOFyCdw5V1ERqN3/OGcKbS5NztHaZDk9mMkgRHbdHe8
+q\�C����O�#��ܒ�r��mC���A�
,.Z�'D3�5~
+m��֒�*��N{)�}W���jxn=��6�Ծ�$�
\ No newline at end of file
-- 
2.51.2