finally system boots with new config

need to add all my stuff btw

modules/networking/core/default.nix

@@ -1,38 +1,38 @@
-{ ... }:
-
+{ config, lib, ... }:
+let
+  cfg = config.workstation.networking.core;
+in
 {
   imports = [
     ./firewall.nix
   ];
 
-  networking = {
-    networkmanager = {
+  config = {
+    networking = {
+      networkmanager = {
+        enable = true;
+        dns = "systemd-resolved";
+      };
+
+      extraHosts = lib.concatMapStringsSep "\n" (
+        host: "${host.ip_address} ${host.hostname}"
+      ) cfg.extraHosts;
+
+      nftables.enable = true;
+
+      nameservers = cfg.nameservers;
+    };
+
+    services.resolved = {
       enable = true;
-      dns = "systemd-resolved";
+
+      settings.Resolve = {
+        dnssec = "true";
+        DNSOverTLS = "true";
+        domains = [ "~." ];
+        fallbackDns = cfg.nameservers;
+      };
+
     };
-    extraHosts = "192.168.1.60 laptop";
-    nftables.enable = true;
-
-    nameservers = [
-      "192.168.1.193" # Pi-hole
-      "1.1.1.1" # Cloudflare
-      "1.0.0.1" # Cloudflare (Secondary)
-    ];
-  };
-
-  services.resolved = {
-    enable = true;
-
-    settings.Resolve = {
-      dnssec = "true";
-      DNSOverTLS = "true";
-      domains = [ "~." ];
-      fallbackDns = [
-        "192.168.1.193" # Pi-hole
-        "1.1.1.1" # Cloudflare
-        "1.0.0.1" # Cloudflare (Secondary)
-      ];
-    };
-
   };
 }

modules/networking/core/firewall.nix

@@ -1,17 +1,14 @@
-{ ... }:
-
+{ config, ... }:
+let
+  cfg = config.workstation.networking.core.firewall;
+in
 {
   networking.firewall = {
     enable = true;
 
-    allowPing = true;
+    allowPing = cfg.allowPing;
 
-    allowedTCPPorts = [
-      22
-      80
-    ];
-    allowedUDPPorts = [
-      53
-    ];
+    allowedTCPPorts = cfg.ports.tcp;
+    allowedUDPPorts = cfg.ports.udp;
   };
 }

modules/networking/default.nix

@@ -1,8 +1,8 @@
-{ ... }:
-
 {
   imports = [
+    ./options.nix
     ./core
+    ./wireguard.nix
     ./tailscale.nix
   ];
 }

modules/networking/options.nix

@@ -0,0 +1,122 @@
+{
+  lib,
+  ...
+}:
+{
+  options.workstation.networking = {
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "river";
+      description = "The user to run tailscale's services as.";
+    };
+
+    # core
+    core = {
+      firewall = {
+        allowPing = lib.mkEnableOption "ICMP pinging" // {
+          default = true;
+        };
+
+        ports = {
+          tcp = lib.mkOption {
+            type = with lib.types; listOf number;
+            default = [
+              22
+              80
+            ];
+          };
+          udp = lib.mkOption {
+            type = with lib.types; listOf number;
+            default = [ 53 ];
+          };
+        };
+      };
+
+      extraHosts = lib.mkOption {
+        type =
+          with lib.types;
+          listOf (
+            submodule (
+              { ... }: {
+                options = {
+                  ip_address = lib.mkOption {
+                    type = str;
+                  };
+
+                  hostname = lib.mkOption {
+                    type = str;
+                  };
+                };
+              }
+            )
+          );
+
+        default = [ ];
+        description = "Additional hosts to add.";
+      };
+
+      nameservers = lib.mkOption {
+        type = with lib.types; listOf str;
+
+        default = [
+          "192.168.1.193"
+          "1.1.1.1"
+          "1.0.0.1"
+        ];
+        description = "DNS Resolvers for System";
+      };
+    };
+
+    # wireguard
+    wireguard = {
+      enable = lib.mkEnableOption "Wireguard support";
+
+      interfaces = lib.mkOption {
+        type = lib.types.attrsOf (
+          lib.types.submodule {
+            options = {
+              enable = lib.mkEnableOption "Enable this WG interface";
+
+              address = lib.mkOption {
+                type = lib.types.listOf lib.types.str;
+                default = [ ];
+              };
+
+              privateKeyFile = lib.mkOption {
+                type = lib.types.str;
+              };
+
+              peers = lib.mkOption {
+                type = lib.types.listOf (
+                  lib.types.submodule {
+                    options = {
+                      publicKey = lib.mkOption { type = lib.types.str; };
+                      allowedIPs = lib.mkOption {
+                        type = lib.types.listOf lib.types.str;
+                        default = [ ];
+                      };
+                      endpoint = lib.mkOption {
+                        type = lib.types.str;
+                        default = "";
+                      };
+                      persistentKeepalive = lib.mkOption {
+                        type = lib.types.nullOr lib.types.int;
+                        default = null;
+                      };
+                    };
+                  }
+                );
+                default = [ ];
+              };
+            };
+          }
+        );
+      };
+    };
+
+    # tailscale
+    tailscale = {
+      enable = lib.mkEnableOption "Tailscale mesh VPN";
+    };
+  };
+}

modules/networking/tailscale.nix

@@ -1,25 +1,30 @@
-{ config, ... }:
-
+{ config, lib, ... }:
+let
+  cfg = config.workstation.networking.tailscale;
+  user = config.workstation.networking.user;
+in
 {
-  services.tailscale = {
-    enable = true;
-    openFirewall = true;
-    extraSetFlags = [ "--operator=river" ];
+  config = lib.mkIf cfg.enable {
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      extraSetFlags = [ "--operator=${user}" ];
+    };
+
+    networking.firewall = {
+      trustedInterfaces = [ config.services.tailscale.interfaceName ];
+      allowedUDPPorts = [ config.services.tailscale.port ];
+    };
+
+    systemd.services.tailscaled.serviceConfig.Environment = [
+      "TS_DEBUG_FIREWALL_MODE=nftables"
+    ];
+
+    systemd.network.wait-online.enable = false;
+    boot.initrd.systemd.network.wait-online.enable = false;
+
+    users.users.${user}.extraGroups = [
+      "tailscale"
+    ];
   };
-
-  networking.firewall = {
-    trustedInterfaces = [ config.services.tailscale.interfaceName ];
-    allowedUDPPorts = [ config.services.tailscale.port ];
-  };
-
-  systemd.services.tailscaled.serviceConfig.Environment = [
-    "TS_DEBUG_FIREWALL_MODE=nftables"
-  ];
-
-  systemd.network.wait-online.enable = false;
-  boot.initrd.systemd.network.wait-online.enable = false;
-
-  users.users.river.extraGroups = [
-    "tailscale"
-  ];
 }

modules/networking/wireguard.nix

@@ -1,22 +1,21 @@
-{ ... }:
-
+{ config, lib, ... }:
+let
+  cfg = config.workstation.networking.wireguard;
+in
 {
-  networking.wireguard.interfaces = {
-    wg0 = {
-      ips = [ "10.0.0.2/24" ];
-      privateKeyFile = "/etc/wireguard/private.key"; # Keep secrets out of the nix store!
+  config = lib.mkIf cfg.enable {
+    networking.wg-quick.interfaces = lib.mapAttrs (name: iface: {
+      address = iface.address;
+      privateKeyFile = iface.privateKeyFile;
+      peers = map (p: {
+        publicKey = p.publicKey;
+        allowedIPs = p.allowedIPs;
+        endpoint = p.endpoint;
 
-      peers = [
-        {
-          publicKey = "vUUL4CD+1Sa2U2SZYa2P9IoFC2HxEr+PYNmYfRE8wwY=";
-          allowedIPs = [ "0.0.0.0/0" ];
-          endpoint = "server.maariz.org:51820";
-          persistentKeepalive = 25;
-        }
-      ];
-    };
+        persistentKeepalive = if p.persistentKeepalive != null then p.persistentKeepalive else null;
+      }) iface.peers;
+    }) (lib.filterAttrs (_: v: v.enable) cfg.interfaces);
+
+    networking.firewall.allowedUDPPorts = [ 51820 ];
   };
-
-  # Ensure the Wireguard UDP port is open if you are hosting the server
-  networking.firewall.allowedUDPPorts = [ 51820 ];
 }