finally works again

hosts/desktop/default.nix

@@ -4,18 +4,15 @@
   imports = [
     ./hardware-configuration.nix
 
-	../../modules/network.nix
-	../../modules/ssh.nix
-	../../modules/wireguard.nix
-	../../modules/tailscale.nix
+    ../../modules/site/blog.nix
+    ../../modules/site/code.nix
+    ../../modules/site/mail.nix
+    ../../modules/site/music.nix
+    ../../modules/site/photo.nix
 
-	../../modules/site.nix
-	../../modules/gitea.nix
-	../../modules/navidrome.nix
-	../../modules/immich.nix
+	../../modules/ssh.nix
   ];
 
-  network.node = "desktop";
   networking.hostName = "desktop";
 
   users.users.lilac = {
@@ -105,8 +102,31 @@
   environment.systemPackages = with pkgs; [
     whipper
 	flac
+	tor-browser
   ];
 
+  programs.steam.enable = true;
+
+  networking = {
+    firewall = {
+	  enable = true;
+	  allowedUDPPorts = [ 51820 ];
+	  trustedInterfaces = [ "wg0" ];
+	};
+
+	wireguard.interfaces."wg0" = {
+      ips = [ "10.0.0.2/24" ];
+	  generatePrivateKeyFile = true;
+	  privateKeyFile = "/var/lib/wireguard/wg0.key";
+	  peers = [{
+        publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
+		allowedIPs = [ "10.0.0.0/24" ];
+		endpoint = "216.128.177.13:51820";
+		persistentKeepalive = 25;
+	  }];
+	};
+  };
+
   nixpkgs.config.allowUnfree = true;
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   system.stateVersion = "26.05";

hosts/vps/default.nix

@@ -4,17 +4,71 @@
   imports = [
     ./hardware-configuration.nix
 
-    ../../modules/network.nix
     ../../modules/ssh.nix
-    ../../modules/wireguard.nix
-	../../modules/headscale.nix
-
-    ../../modules/http-forwarding.nix
   ];
 
-  network.node = "vps";
   networking.hostName = "vps";
 
+  users.users.lilac = {
+    isNormalUser = true;
+	group = "lilac";
+	extraGroups = [ "wheel" ];
+  };
+  users.groups.lilac = {};
+  home-manager = {
+    useGlobalPkgs = true;
+    useUserPackages = true;
+    users.lilac = import ../../home/lilac.nix;
+  };
+  programs.zsh.enable = true;
+  users.users.lilac.shell = pkgs.zsh;
+  security.sudo.wheelNeedsPassword = false;
+
+  # forwarding inbound network traffic over wireguard
+  networking = {
+    firewall = {
+	  enable = true;
+	  allowedTCPPorts = [ 80 443 ];
+	  allowedUDPPorts = [ 51820 ];
+	  trustedInterfaces = [ "wg0" ];
+	};
+	wireguard.interfaces."wg0" = {
+      ips = [ "10.0.0.3/24" ];
+	  listenPort = 51820;
+	  generatePrivateKeyFile = true;
+	  privateKeyFile = "/var/lib/wireguard/wg0.key";
+	  peers = [
+	    {
+		  allowedIPs = [ "10.0.0.1/32" ];
+          publicKey = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU=";
+		}
+		{
+          allowedIPs = [ "10.0.0.2/32" ];
+		  publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
+		}
+      ];
+	};
+	nftables = {
+	  enable = true;
+	  tables.nat = {
+	    family = "ip";
+		content = ''
+          chain prerouting {
+            type nat hook prerouting priority dstnat; policy accept;
+            iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
+          }
+	      chain postrouting {
+            type nat hook postrouting priority srcnat; policy accept;
+            oifname "wg0" masquerade
+          }
+        '';
+      };
+	};
+  };
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+  };
+
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   system.stateVersion = "26.05";
 }

hosts/vps/hardware-configuration.nix

@@ -7,11 +7,11 @@
 	extraModulePackages = [ ];
   	loader.systemd-boot.enable = true;
   	loader.efi.canTouchEfiVariables = true;
-  	loader.efi.efiSysMountPoint = "/boot";
+  	loader.efi.efiSysMountPoint = "/boot/efi";
   };
 
   fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; };
-  fileSystems."/boot" = { device = "/dev/vda1"; fsType = "vfat"; };
+  fileSystems."/boot/efi" = { device = "/dev/vda1"; fsType = "vfat"; };
   swapDevices = [ ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";