2 files changed, 4 insertions, 33 deletions
diff --git a/modules/tunnel/definition.nix b/modules/tunnel/definition.nix
index 74ae268..82534bf 100644
--- a/modules/tunnel/definition.nix
+++ b/modules/tunnel/definition.nix
@@ -36,40 +36,11 @@
     }
   ];
 
-  # there are our users who are allowed to connect to any of our "paths".
-  # their ip is always a template, with 'X' representing the path index.
-  users = {
-    mel = {
-      key = "vnZoHXapCLLUhZ8A8R5W0iJ8LpWVLve29z41kkoT0BU=";
-      ip = "10.123.X.101";
-    };
-
-    andrei = {
-      key = "qqU4uYImLfUohIwl4KBshPtTINFcs0JVALjbmwpfxRg=";
-      ip = "10.123.X.102";
-    };
-
-    sergo = {
-      key = "qbZGMNIDZFCJC6SHtlyNIlIdGWHELceXClJCcagrj2Y=";
-      ip = "10.123.X.103";
-    };
-
-    fedor = {
-      key = "tEO9r8+jTpu8TBRmZ+/v087IgD/QfmofLUKs249i/F0=";
-      ip = "10.123.X.104";
-    };
-  };
+  inherit (import ../../assets/vpn.nix) users;
 
   # we use a website as a "mask" for vless/reality, which will tell our peers
   # to pretend as if they're a user and a well-known website communicating with
   # each other, even though they know that the keys don't actually match up,
   # it's not possible to see that on the outside.
   mask = "microsoft.com";
-
-  # we don't actually need this to configure the tunnel, but this is
-  # the public key of the ingress interface.
-  # when creating wireguard vpn configurations for the users, this
-  # is the public key of the server peer at `tunnel.rnrd.eu`.
-  # the matching private key of the pair is the secret `tunnel/ingress-key`.
-  ingress.public = "s5yyPCJiN0uqW0jzKIbYCF7I9TthymiRzpNt466XeWk=";
 }
diff --git a/modules/tunnel/ingress.nix b/modules/tunnel/ingress.nix
index 1ea1613..f609f3d 100644
--- a/modules/tunnel/ingress.nix
+++ b/modules/tunnel/ingress.nix
@@ -38,8 +38,8 @@ in
     checkReversePath = "loose";
   };
 
-  age.secrets.ingress-key = {
-    file = ../../secrets/tunnel/ingress-key.age;
+  age.secrets.wg-private-key = {
+    file = ../../secrets/wg-private-key.age;
     owner = "systemd-network";
   };
 
@@ -52,7 +52,7 @@ in
             Name = ingressName index;
           };
           wireguardConfig = {
-            PrivateKeyFile = config.age.secrets.ingress-key.path;
+            PrivateKeyFile = config.age.secrets.wg-private-key.path;
             ListenPort = path.port;
           };
           wireguardPeers = map (user: {