Subject: [bug#73955] [PATCH v3 3/3] services: wireguard: Support gexps for peer preshared keys.

From: Richard Sent <[email-masked]>
Date: Mon, 04 Nov 2024 09:53:49 -0500

> Do you think that it would make sense to also update the documentation
> for the "preshared-key" field, to mention that it can be a gexp?

Makes sense to me!

> (wireguard-configuration
>  (private-key (file-redirect
>                (get-secret-program-file "foo"))))

I'm also realizing that while the wireguard.conf generated in my example is correct, we still bootstrap a private key at file path <(/gnu/store...), which isn't ideal.

We could only attempt to bootstrap "reasonable" file names (i.e. those that start with a /), but this feels icky and <(foo) is technically a valid file name.

I quite like how utilizing the private-key field for commands instead of a file path works (as opposed to a rather ugly manual postup), so perhaps a bootstrap-private-key? field should be added. As long as it defaults to #t I don't see it impacting existing setups.