semi-spread example: serve internal vhosts on the VPN addresses only, over IPv4 and IPv6

docs/examples/semi-spread/wireguard.nix

@@ -1,6 +1,6 @@
 # The VPN: plain NixOS WireGuard, one interface `wg0`, a full mesh built from
-# ./mesh.nix. Identical on every host; the host's own entry is picked by
-# `networking.hostName`.
+# ./mesh.nix, carrying IPv4 and IPv6. Identical on every host; the host's own
+# entry is picked by `networking.hostName`.
 { config, lib, ... }:
 let
   mesh = import ./mesh.nix;
@@ -8,13 +8,19 @@ let
 in
 {
   networking.wireguard.interfaces.wg0 = {
-    ips = [ "${mesh.${self}.address}/24" ];
+    ips = [
+      "${mesh.${self}.address}/24"
+      "${mesh.${self}.address6}/64"
+    ];
     listenPort = 51820;
     # Created on the host by `wg genkey`, never in the store.
     privateKeyFile = "/etc/wireguard/wg0.key";
     peers = lib.mapAttrsToList (_: peer: {
       inherit (peer) publicKey endpoint;
-      allowedIPs = [ "${peer.address}/32" ];
+      allowedIPs = [
+        "${peer.address}/32"
+        "${peer.address6}/128"
+      ];
       persistentKeepalive = 25;
     }) (removeAttrs mesh [ self ]);
   };