3 files changed, 9 insertions, 4 deletions

diff --git a/hosts/surtr/vpn/default.nix b/hosts/surtr/vpn/default.nix
index 1bdcf74e..1ebcc760 100644
--- a/hosts/surtr/vpn/default.nix
+++ b/hosts/surtr/vpn/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, config, lib, ... }:
+{ flake, pkgs, config, lib, ... }:
 
 with lib;
 
@@ -22,7 +22,11 @@ in {
         "--load-credential=surtr.priv:/run/credentials/container@vpn.service/surtr.priv"
         "--network-ipvlan=ens3:upstream"
       ];
-      config = {
+      config = let hostConfig = config; in { config, pkgs, ... }: {
+        system.stateVersion = lib.mkIf hostConfig.containers."vpn".ephemeral config.system.nixos.release;
+        system.configurationRevision = mkIf (flake ? rev) flake.rev;
+        nixpkgs.pkgs = hostConfig.nixpkgs.pkgs;
+
         boot.kernel.sysctl = {
           "net.core.rmem_max" = 4194304;
           "net.core.wmem_max" = 4194304;
@@ -86,7 +90,7 @@ in {
               wireguardPeers = imap1 (i: { name, ip ? i }: {
                 AllowedIPs = ["${prefix6}:${toString ip}::/96" "${prefix4}.${toString ip}/32"];
                 PublicKey = trim (readFile (./. + "/${name}.pub"));
-              }) [ { name = "geri"; } { name = "sif"; } ];
+              }) [ { name = "geri"; } { name = "sif"; } { name = "skadhi"; } ];
             };
           };
 
diff --git a/hosts/surtr/vpn/geri.pub b/hosts/surtr/vpn/geri.pub
index ed5de2b2..2cd9b24e 100644
--- a/hosts/surtr/vpn/geri.pub
+++ b/hosts/surtr/vpn/geri.pub
@@ -1 +1 @@
-sYuQSNZHzfegv8HRz71jnZm2nFLGeRnaGwVonhKUj2k=
+hhER05bvstOTGfiAG3IJsFkBNWCUZHokBXwaiC5d534=
diff --git a/hosts/surtr/vpn/skadhi.pub b/hosts/surtr/vpn/skadhi.pub
new file mode 100644
index 00000000..045952c5
--- /dev/null
+++ b/hosts/surtr/vpn/skadhi.pub
@@ -0,0 +1 @@
+rrKm3gvBtFK6WB5A6FCpQ+w6/0aOuvsBDNQLFW7s9jQ=