claude'd better security things

services/wg.nix

@@ -2,13 +2,14 @@
   pkgs,
   service_configs,
   eth_interface,
+  config,
   ...
 }:
 {
   # network namespace that is proxied through mullvad
   vpnNamespaces.wg = {
     enable = true;
-    wireguardConfigFile = ../secrets/wg0.conf;
+    wireguardConfigFile = config.age.secrets.wg0-conf.path;
     accessibleFrom = [
       # "192.168.0.0/24"
     ];
@@ -20,13 +21,15 @@
       "network.target"
       "jellyfin.service"
       "qbittorrent.service"
+      "agenix.service"
     ];
+    requires = [ "agenix.service" ];
     wantedBy = [ "multi-user.target" ];
 
     serviceConfig = {
       Type = "simple";
       ExecStart = pkgs.writeShellScript "jellyfin-monitor-start" ''
-        export JELLYFIN_API_KEY=$(cat ${../secrets/jellyfin-api-key})
+        export JELLYFIN_API_KEY=$(cat ${config.age.secrets.jellyfin-api-key.path})
         exec ${
           pkgs.python3.withPackages (ps: with ps; [ requests ])
         }/bin/python ${./jellyfin-qbittorrent-monitor.py}