From faf1e32c8a6bdaf5616f075fcca1e2ee121cebe2 Mon Sep 17 00:00:00 2001
From: Grisha Shipunov
Date: Fri, 29 Aug 2025 13:15:13 +0200
Subject: allow null private key for non-flake clients

---
 modules/wg/module.nix  | 8 ++++++--
 modules/wg/options.nix | 4 +++-
 2 files changed, 9 insertions(+), 3 deletions(-)

(limited to 'modules/wg')

diff --git a/modules/wg/module.nix b/modules/wg/module.nix
index 53ed2bb..45a9335 100644
--- a/modules/wg/module.nix
+++ b/modules/wg/module.nix
@@ -50,7 +50,9 @@
             Kind = "wireguard";
             Name = "wg-${net.networkName}";
           };
-          wireguardConfig.PrivateKeyFile = net.hosts.${currenthost}.privateKeyFile;
+          wireguardConfig.PrivateKeyFile =
+            assert !(isNull net.hosts.${currenthost}.privateKeyFile);
+            net.hosts.${currenthost}.privateKeyFile;
           # for client this is only endpoint for now
           wireguardPeers =
             let
@@ -88,7 +90,9 @@
             Kind = "wireguard";
             Name = "wg-${net.networkName}";
           };
-          wireguardConfig.PrivateKeyFile = net.hosts.${currenthost}.privateKeyFile;
+          wireguardConfig.PrivateKeyFile =
+            assert !(isNull net.hosts.${currenthost}.privateKeyFile);
+            net.hosts.${currenthost}.privateKeyFile;
           wireguardConfig.ListenPort = net.hosts.${currenthost}.endpoint.port;
           wireguardPeers =
             let
diff --git a/modules/wg/options.nix b/modules/wg/options.nix
index d4e8567..c5ed665 100644
--- a/modules/wg/options.nix
+++ b/modules/wg/options.nix
@@ -39,7 +39,9 @@
                       default = null;
                     };
                     privateKeyFile = mkOption {
-                      type = types.path;
+                      # nullOr because non-flake hosts don't need a private key in this repo
+                      # assert in the module checks for the key presence on flake hosts
+                      type = types.nullOr types.path;
                       default = null;
                     };
 
-- 
cgit v1.3.1