added secureHost flag

hosts/server/configuration.nix

@@ -1,6 +1,7 @@
 {
   pkgs,
   config,
+  lib,
   ...
 }:
 {
@@ -35,14 +36,16 @@
       supportedFeatures = config.my.nix.features;
     }
   ];
-  sops.secrets."vps/home/private".sopsFile = ../../secrets/wireguard.yaml;
+  sops.secrets."vps/home/private" = lib.mkIf config.my.secureHost {
+    sopsFile = ../../secrets/wireguard.yaml;
+  };
   networking = {
     hostName = "server";
     firewall = {
       allowedUDPPorts = config.networking.firewall.allowedTCPPorts;
       interfaces.wg0.allowedTCPPorts = [ 8081 ];
     };
-    wireguard.interfaces.wg0 = {
+    wireguard.interfaces.wg0 = lib.mkIf config.my.secureHost {
       ips = [ "${config.my.ips.wg-server}/32" ];
       privateKeyFile = config.sops.secrets."vps/home/private".path;
       peers = [