wireguard: setup VPN

base/default.nix

@@ -1,6 +1,7 @@
 { ... }:
 {
   imports = [
+    ./networking.nix
     ./nix.nix
     ./users.nix
   ];

base/networking.nix

@@ -0,0 +1,12 @@
+{ lib, ... }:
+{
+  options.my.networking.externalInterface = with lib; mkOption {
+    type = types.nullOr types.str;
+    default = null;
+    example = "eth0";
+    description = ''
+      Name of the network interface that egresses to the internet. Used for
+      e.g. NATing internal networks.
+    '';
+  };
+}