added system to dirs

modules/system/vpn-confinement/default.nix

@@ -0,0 +1,41 @@
+{ pkgs, config, lib, ... }:
+
+let
+  cfg = config.system.vpn-confinement;
+in
+{
+  options.system.vpn-confinement = {
+    enable = lib.mkEnableOption "enables vpn-confinement";
+  
+    # toggle for mullvad mexico w/ openvpn
+    vpncon_mex = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "enable pia vpn to mexico using openvpn";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    
+    # Define VPN network namespace
+    vpnNamespaces.wgmex = {
+      enable = true;
+      wireguardConfigFile = "/etc/wireguard/mullvad.conf";
+      accessibleFrom = [
+        "10.0.0.0/8"
+      ];
+      portMappings = [
+        { from = 7103; to = 7103; }
+      ];
+      openVPNPorts = [{
+        port = 51820;
+        protocol = "both";
+      }];
+    };
+
+    # secrets only if VPN is enabled
+    sops.secrets = {
+      "vpncon_mex_config" = { owner = "root"; group = "root"; };
+    };
+ };
+}