From 3635e27a5a2a4e5526fd21be139f155cc3240bf1 Mon Sep 17 00:00:00 2001
From: ahtlon <git@ahtlon.de>
Date: Mon, 14 Sep 2026 15:58:35 +0200
Subject: [PATCH] [ns1] start wireguard on ns1 also add fallback dns to all vpn
 clients

---
 machines/modules/malobeo/wireguard.nix | 2 +-
 machines/ns1/configuration.nix         | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/machines/modules/malobeo/wireguard.nix b/machines/modules/malobeo/wireguard.nix
index fcb040a..9d606c6 100644
--- a/machines/modules/malobeo/wireguard.nix
+++ b/machines/modules/malobeo/wireguard.nix
@@ -72,7 +72,7 @@ in
           mtu = 1340; #seems to be necessary to proxypass nginx traffic through vpn
           address = [ "${myPeer.address}/24" ];
           autostart = cfg.autostart;
-          dns = [peers.ns1.address];
+          dns = [peers.ns1.address "1.1.1.1"];
           listenPort = mkIf (myPeer.role == "server") myPeer.listenPort;
 
           # This allows the wireguard server to route your traffic to the internet and hence be like a VPN
diff --git a/machines/ns1/configuration.nix b/machines/ns1/configuration.nix
index 7721eea..1b397b9 100644
--- a/machines/ns1/configuration.nix
+++ b/machines/ns1/configuration.nix
@@ -17,6 +17,7 @@ in
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
     ../modules/autoupdate.nix
+    inputs.self.nixosModules.malobeo.vpn
   ];
 
   networking.firewall = {
@@ -25,6 +26,14 @@ in
     allowedUDPPorts = [ 53 ];
   };
 
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.secrets.wg_private = {};
+  services.malobeo.vpn = {
+    enable = true;
+    name = "ns1";
+    privateKeyFile = config.sops.secrets.wg_private.path;
+  };
+
   services.bind = {
     enable = true;
     forwarders = [