{ pkgs, ...}:

let
  confRoot = "/etc/wireguard/";
in

{
  networking.firewall.allowedUDPPorts = [ 51902 ];

  networking.wireguard.interfaces.wg0 = {
    listenPort = 51902;
    ips = [ "192.168.10.25/24" ];

    privateKeyFile = confRoot + "dsrt.key";

    peers = [
      # Contabo vps
      {
        publicKey = "vl+9VfNzyTudKcPOWszaCzTZ9Sn0w5dX1E6I5LdAvDQ=";
        allowedIPs = [ "192.168.10.0/24" ];
        presharedKeyFile = confRoot + "dsrt.psk";

        endpoint = "vpn.morj.men:51902";
        # keep alive for incoming traffic
        persistentKeepalive = 25;
      }
    ];
  };
}