diff options
| -rw-r--r-- | hosts/ganymede/caddy.nix | 20 | ||||
| -rw-r--r-- | hosts/ganymede/config.nix | 23 | ||||
| -rw-r--r-- | modules/services/nixos/selfhost/default.nix | 1 | ||||
| -rw-r--r-- | modules/services/nixos/selfhost/headscale.nix | 55 | ||||
| -rw-r--r-- | modules/services/options.nix | 32 |
5 files changed, 106 insertions, 25 deletions
diff --git a/hosts/ganymede/caddy.nix b/hosts/ganymede/caddy.nix index b073f9a..e6f18ab 100644 --- a/hosts/ganymede/caddy.nix +++ b/hosts/ganymede/caddy.nix @@ -12,24 +12,22 @@ hash = "sha256-BQdm8p9eDGhRu6mKyX2FAUaKoU6Lv2A746Sey39T13I="; }); - extraConfig = '' - { - acme_dns porkbun { - api_key {env.PORKBUN_API_KEY} - api_secret_key {env.PORKBUN_API_SECRET_KEY} - } + globalConfig = '' + acme_dns porkbun { + api_key {env.PORKBUN_API_KEY} + api_secret_key {env.PORKBUN_API_SECRET_KEY} } ''; virtualHosts."https://web.tail7cca06.ts.net".extraConfig = '' bind tailscale/web - root * /var/www/williams_web + root * /var/www file_server + ''; - handle_path /papa_stories/* { - root * /var/www/papa_stories - file_server - } + virtualHosts."https://williamsfam.us.com".extraConfig = '' + root * /var/www + file_server ''; }; } diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index 50ef29a..c2b312f 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -1,4 +1,6 @@ -{config, ...}: { +{config, ...}: let + tailscaleIP = "100.69.180.89"; +in { collinux = { user.name = "collin"; @@ -32,12 +34,25 @@ }; }; tailscale.enable = true; - sshd.enable = true; + sshd = { + enable = true; + bind_host = tailscaleIP; + }; }; selfhost = { - adguard.enable = true; - forgejo.enable = true; + adguard = { + enable = true; + bind_host = tailscaleIP; + }; + forgejo = { + enable = true; + bind_host = tailscaleIP; + }; + headscale = { + enable = true; + root_url = "https://headscale.williamsfam.us.com"; + }; caddy = { enable = true; envFile = config.collinux.secrets."caddy-env".path; diff --git a/modules/services/nixos/selfhost/default.nix b/modules/services/nixos/selfhost/default.nix index 876586d..de1078b 100644 --- a/modules/services/nixos/selfhost/default.nix +++ b/modules/services/nixos/selfhost/default.nix @@ -2,6 +2,7 @@ imports = [ ./adguard.nix ./forgejo.nix + ./headscale.nix ./caddy.nix ]; } diff --git a/modules/services/nixos/selfhost/headscale.nix b/modules/services/nixos/selfhost/headscale.nix new file mode 100644 index 0000000..9319691 --- /dev/null +++ b/modules/services/nixos/selfhost/headscale.nix @@ -0,0 +1,55 @@ +{ + config, + pkgs, + lib, + ... +}: let + cfg = config.collinux.services.selfhost.headscale; + + acl_file = (pkgs.formats.json {}).generate "acl.json" { + ssh = { + src = ["*"]; + dst = ["*"]; + users = ["autogroup:nonroot" "root"]; + action = "accept"; + }; + }; +in + lib.mkIf cfg.enable { + services.headscale = { + enable = true; + address = cfg.bind_host; + port = cfg.port; + settings = { + server_url = cfg.root_url; + + database.type = "sqlite"; + + dns = { + magic_dns = true; + base_domain = "collinux.tailnet"; + override_local_dns = true; + nameservers.global = ["9.9.9.9" "149.112.112.112" "2620:fe::fe" "2620:fe::9"]; + }; + + policy.path = "${acl_file}"; + + prefixes = { + "v4" = "100.100.0.0/16"; + allocation = "random"; + }; + + # leave tls for caddy to worry about + tls_cert_path = null; + tls_key_path = null; + + logtail.enabled = false; + }; + }; + + services.caddy.virtualHosts.${cfg.root_url}.extraConfig = lib.mkIf config.collinux.services.selfhost.caddy.enable '' + reverse_proxy localhost:8080 + ''; + + environment.systemPackages = [pkgs.headscale]; + } diff --git a/modules/services/options.nix b/modules/services/options.nix index f42dd12..2084c45 100644 --- a/modules/services/options.nix +++ b/modules/services/options.nix @@ -31,8 +31,20 @@ in { default = null; }; }; - tailscale.enable = mkEnableOption "tailscale"; - sshd.enable = mkEnableOption "OpenSSH server"; + tailscale = { + enable = mkEnableOption "tailscale"; + tailnet = mkOption { + type = lib.types.str; + default = "tail7cca06.ts.net"; + }; + }; + sshd = { + enable = mkEnableOption "OpenSSH server"; + bind_host = mkOption { + type = ip_addr; + default = "0.0.0.0"; + }; + }; }; audio = { enable = mkEnableOption "pipewire + wireplumber"; @@ -54,21 +66,17 @@ in { enable = mkEnableOption ""; bind_host = mkOption { type = ip_addr; - default = - if config.collinux.services.networking.tailscale.enable - then "100.69.160.89" - else "0.0.0.0"; + default = "0.0.0.0"; }; port = mkOption { type = lib.types.port; default = default_port; }; - root_url = mkOption { type = lib.types.str; - default = - if config.collinux.services.networking.tailscale.enable - then "https://${service_name}.tail7cca06.ts.net" + default = with config.collinux.services.networking.tailscale; + if enable + then "https://${service_name}.${tailnet}" else null; }; }; @@ -81,6 +89,10 @@ in { service_name = "forgejo"; default_port = 8010; }; + headscale = selfhostOptions { + service_name = "headscale"; + default_port = 8080; + }; caddy = { enable = mkEnableOption "caddy https server"; envFile = mkOption { |