add a semi-spread example deploy and a check that evaluates it

docs/examples/semi-spread/wireguard.nix

@@ -0,0 +1,24 @@
+# The VPN: plain NixOS WireGuard, one interface `wg0`, a full mesh built from
+# ./mesh.nix. Identical on every host; the host's own entry is picked by
+# `networking.hostName`.
+{ config, lib, ... }:
+let
+  mesh = import ./mesh.nix;
+  self = config.networking.hostName;
+in
+{
+  networking.wireguard.interfaces.wg0 = {
+    ips = [ "${mesh.${self}.address}/24" ];
+    listenPort = 51820;
+    # Created on the host by `wg genkey`, never in the store.
+    privateKeyFile = "/etc/wireguard/wg0.key";
+    peers = lib.mapAttrsToList (_: peer: {
+      inherit (peer) publicKey endpoint;
+      allowedIPs = [ "${peer.address}/32" ];
+      persistentKeepalive = 25;
+    }) (removeAttrs mesh [ self ]);
+  };
+
+  # The handshake arrives on the public interface.
+  networking.firewall.allowedUDPPorts = [ config.networking.wireguard.interfaces.wg0.listenPort ];
+}