make-monitoring.nix

{ publicIPv4, hardware, publicStoragePort, ristrettoSigningKeyPath, passValue, sshUsers, stateVersion, ... }: rec {

  deployment = {
    targetHost = publicIPv4;

    secrets = {
      "monitoringvpn-private-key" = {
        source = "../../PrivateStorageSecrets/monitoringvpn/server.key";
        destination = "/var/secrets/monitoringvpn/server.key";
        owner.user = "root";
        owner.group = "root";
        permissions = "0400";
        action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
      };
      "monitoringvpn-public-key" = {
        source = "../../PrivateStorageSecrets/monitoringvpn/server.pub";
        destination = "/var/secrets/monitoringvpn/server.pub";
        owner.user = "root";
        owner.group = "root";
        permissions = "0444";
        action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
      };
    };
  };

  imports = [
    hardware
    ../../nixos/modules/monitoring/vpn/server.nix
  ];

  services.private-storage.monitoring.vpn.server = {
    enable = true;
    ip = "172.23.23.1";
  };

  system.stateVersion = stateVersion;
}