Adds separate nano and Keyhole WireGuard networks on Sayaka (reef joins both), with encrypted per-host WG keys, explicit peer registrations, Keyhole + its cleartext WG interface in a Sayaka network namespace, and only Jellyfin/Flood/qBit API egress through a veth to homura. Keyhole credentials are age-encrypted and loaded through systemd, not stored in Nix JSON. Rebuild Sayaka first, then reef; no Tailscale subnet router. Reef NixOS toplevel built successfully and targeted Sayaka module evaluations passed; a full Sayaka toplevel build was blocked from reef by the existing Orpheus module referencing /home/callie/code/orpheus. No production WG deployment was done. See modules/nano-wireguard/README.md for joining future hosts.
Something went wrong. Try again.
NixOS configuration for all my personal hosts.
Something went wrong. Try again.
Declarative nano and Keyhole WireGuard networks on Sayaka #36
Closed 
nano.sharkgirl.pet
nano.sharkgirl.pet targeting main from nano.sharkgirl.pet/nix:feat/nano-keyhole-wireguard
Closed opened by and assigned to nano.sharkgirl.pet targeting main from nano.sharkgirl.pet/nix:feat/nano-keyhole-wireguard
nano.sharkgirl.pet targeting main from nano.sharkgirl.pet/nix:feat/nano-keyhole-wireguard Commits 6
Remove leftover gap after Sayaka CoreDNS extraction
Terminate Keyhole WireGuard domains with DNS-01 TLS only
Keep CoreDNS zone directives at column zero
Clarify Keyhole DNS and WireGuard socket placement
Route Keyhole domains through private Nginx and Sayaka CoreDNS
Add declarative nano and Keyhole WireGuard networks on Sayaka