no idea

hosts/workstation/configuration.nix

@@ -1,12 +1,12 @@
 {
   pkgs,
   config,
+  lib,
   inputs,
   ...
 }:
 let
   shellType = config.my.shell.type;
-  comfyuiPort = 8188;
   krita-thumbnailer = pkgs.writeTextFile {
     name = "krita-thumbnailer";
     destination = "/share/thumbnailers/kra.thumbnailer";
@@ -38,6 +38,9 @@ in
       "bearded_dragonn"
     ];
   };
+  sops.secrets."workstation/private" = lib.mkIf config.my.secureHost {
+    sopsFile = ../../secrets/wireguard.yaml;
+  };
   home-manager.users.jawz.programs = {
     vscode = {
       enable = true;
@@ -57,8 +60,8 @@ in
     hostName = "workstation";
     firewall = {
       allowedTCPPorts = [
-        6674 # ns-usbloader
-        8384 # syncthing
+        config.my.ports.nsUsbloader
+        config.my.ports.syncthingGui
       ];
       allowedTCPPortRanges = [
         {
@@ -70,7 +73,31 @@ in
         config.services.ollama.port
         config.services.open-webui.port
         config.services.sillytavern.port
-        comfyuiPort
+        config.my.ports.comfyui
+      ];
+    };
+    nftables.tables.wg-local-redirect = {
+      family = "ip";
+      content = ''
+        chain prerouting {
+          type nat hook prerouting priority dstnat;
+          iifname "wg0" ip daddr ${config.my.ips.wg-workstation}/32 tcp dport ${toString config.my.ports.sillytavern} redirect to :${toString config.my.ports.sillytavern}
+        }
+      '';
+    };
+    wireguard.interfaces.wg0 = lib.mkIf config.my.secureHost {
+      ips = [ "${config.my.ips.wg-workstation}/32" ];
+      privateKeyFile = config.sops.secrets."workstation/private".path;
+      peers = [
+        {
+          publicKey = "dFbiSekBwnZomarcS31o5+w6imHjMPNCipkfc2fZ3GY=";
+          endpoint = "${config.my.ips.vps}:51820";
+          persistentKeepalive = 25;
+          allowedIPs = [
+            "${config.my.ips.wg-vps}/32"
+            config.my.subnets.wg-homelab
+          ];
+        }
       ];
     };
   };
@@ -141,7 +168,7 @@ in
     flatpak.enable = true;
     open-webui = {
       enable = true;
-      port = 2345;
+      port = config.my.ports.openWebui;
       host = config.my.ips.wg-workstation;
     };
     scx = {
@@ -162,13 +189,14 @@ in
       models = "/srv/ai/ollama";
       user = "ollama";
       group = "ai";
+      port = config.my.ports.ollama;
       host = config.my.ips.wg-workstation;
     };
     sillytavern = {
       enable = true;
+      port = config.my.ports.sillytavern;
       group = "ai";
-      listen = true;
-      port = 9324;
+      whitelist = true;
       listenAddressIPv4 = config.my.ips.wg-workstation;
     };
   };