11 files changed, 158 insertions, 30 deletions
diff --git a/modules/services/nixos/audio.nix b/modules/services/nixos/audio.nix
index 93f8289..8f2f23e 100644
--- a/modules/services/nixos/audio.nix
+++ b/modules/services/nixos/audio.nix
@@ -12,9 +12,10 @@ in
       enable = true;
       wireplumber.enable = true;
       alsa.enable = true;
-
-      pulse.enable = cfg.pulse.enable;
+      pulse.enable = false;
     };
 
+    boot.blacklistedKernelModules = ["snd_seq_dummy"]; # remove extraneous alsa midi devices
+
     environment.systemPackages = [pkgs.pwvucontrol];
   }
diff --git a/modules/services/nixos/bluetooth.nix b/modules/services/nixos/bluetooth.nix
index a86b5b3..bdcaa00 100644
--- a/modules/services/nixos/bluetooth.nix
+++ b/modules/services/nixos/bluetooth.nix
@@ -12,6 +12,18 @@ in
       powerOnBoot = true;
     };
 
+    # hardening (down to 2.1 OK)
+    systemd.services."bluetooth".serviceConfig = {
+      IPAddressDeny = "any";
+      ProtectHostname = true;
+      ProtectKernelTunables = lib.mkForce true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = lib.mkForce true;
+      RestrictAddressFamilies = ["AF_UNIX" "AF_BLUETOOTH"];
+      ProtectClock = true;
+      ProcSubset = "pid";
+    };
+
     environment.systemPackages = [
       (lib.mkIf cfg.blueman.enable pkgs.blueman)
       (lib.mkIf cfg.bluetuith.enable pkgs.bluetuith)
diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix
index 2667849..9fa56da 100644
--- a/modules/services/nixos/networking/default.nix
+++ b/modules/services/nixos/networking/default.nix
@@ -3,24 +3,8 @@
     ./iwd.nix
     ./networkmanager.nix
     ./networkd.nix
+    ./resolved.nix
   ];
 
   networking.firewall.enable = true;
-
-  # DNS
-  services.resolved = {
-    enable = true;
-    dnsovertls = "opportunistic";
-    fallbackDns = [
-      "9.9.9.9#dns.quad9.net"
-      "149.112.112.112#dns.quad9.net"
-    ];
-
-    # disable extra stuff
-    llmnr = "false";
-    extraConfig = "MulticastDNS=no";
-  };
-  networking.resolvconf.enable = false;
-
-  systemd.network.wait-online.enable = false;
 }
diff --git a/modules/services/nixos/networking/networkd.nix b/modules/services/nixos/networking/networkd.nix
index 9a11129..920b93f 100644
--- a/modules/services/nixos/networking/networkd.nix
+++ b/modules/services/nixos/networking/networkd.nix
@@ -25,6 +25,13 @@ in
 
     systemd.network = {
       enable = true;
+
+      wait-online = {
+        enable = true;
+        ignoredInterfaces = ["docker0"];
+        anyInterface = true;
+      };
+
       networks."11-static-lan" = {
         name = "wl*";
 
diff --git a/modules/services/nixos/networking/resolved.nix b/modules/services/nixos/networking/resolved.nix
new file mode 100644
index 0000000..b552095
--- /dev/null
+++ b/modules/services/nixos/networking/resolved.nix
@@ -0,0 +1,17 @@
+{
+  networking.resolvconf.enable = false;
+
+  services.resolved = {
+    enable = true;
+    dnsovertls = "opportunistic";
+    dnssec = "allow-downgrade";
+    fallbackDns = [
+      "9.9.9.9#dns.quad9.net"
+      "149.112.112.112#dns.quad9.net"
+    ];
+
+    # disable extra stuff
+    llmnr = "false";
+    extraConfig = "MulticastDNS=no";
+  };
+}
diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix
index c5e93ee..69fb8a4 100644
--- a/modules/services/nixos/selfhost/adguard.nix
+++ b/modules/services/nixos/selfhost/adguard.nix
@@ -32,16 +32,16 @@ in
       DNSStubListener=no
     '';
 
-    services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
+    services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups
+
+    services.caddy = lib.mkIf cfg.caddy.enable {
       virtualHosts.${cfg.root_url}.extraConfig = ''
         ${
-          if config.collinux.services.networking.tailscale.enable
-          then "bind tailscale/adguard"
+          if cfg.caddy.bind_tailscale
+          then "bind tailscale/${cfg.service_name}"
           else ""
         }
-        reverse_proxy localhost:${toString cfg.port}
+        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
       '';
     };
-
-    services.tailscale.extraSetFlags = lib.optional config.collinux.services.networking.tailscale.enable "--accept-dns=false"; # would create an infinite loop of dns lookups
   }
diff --git a/modules/services/nixos/selfhost/default.nix b/modules/services/nixos/selfhost/default.nix
index 876586d..de1078b 100644
--- a/modules/services/nixos/selfhost/default.nix
+++ b/modules/services/nixos/selfhost/default.nix
@@ -2,6 +2,7 @@
   imports = [
     ./adguard.nix
     ./forgejo.nix
+    ./headscale.nix
     ./caddy.nix
   ];
 }
diff --git a/modules/services/nixos/selfhost/forgejo.nix b/modules/services/nixos/selfhost/forgejo.nix
index b1a6095..4571dca 100644
--- a/modules/services/nixos/selfhost/forgejo.nix
+++ b/modules/services/nixos/selfhost/forgejo.nix
@@ -8,7 +8,7 @@ in
   lib.mkIf cfg.enable {
     services.forgejo = {
       enable = true;
-      database.type = "postgres";
+      database.type = "sqlite3";
       settings = {
         server = {
           DOMAIN = "localhost";
@@ -36,14 +36,19 @@ in
       };
     };
 
-    services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
+    systemd.services."forgejo" = lib.mkIf config.collinux.services.networking.networkd.enable {
+      after = lib.mkAfter ["network-online.target"];
+      wants = lib.mkAfter ["network-online.target"];
+    };
+
+    services.caddy = lib.mkIf cfg.caddy.enable {
       virtualHosts.${cfg.root_url}.extraConfig = ''
         ${
-          if config.collinux.services.networking.tailscale.enable
-          then "bind tailscale/forgejo"
+          if cfg.caddy.bind_tailscale
+          then "bind tailscale/${cfg.service_name}"
           else ""
         }
-        reverse_proxy localhost:${toString cfg.port}
+        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
       '';
     };
   }
diff --git a/modules/services/nixos/selfhost/headscale.nix b/modules/services/nixos/selfhost/headscale.nix
new file mode 100644
index 0000000..2bdcca1
--- /dev/null
+++ b/modules/services/nixos/selfhost/headscale.nix
@@ -0,0 +1,75 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.services.selfhost.headscale;
+
+  acl_file = (pkgs.formats.json {}).generate "acl.json" {
+    ssh = [
+      {
+        src = ["collin@"];
+        dst = ["collin@"];
+        users = ["autogroup:nonroot" "root"];
+        action = "accept";
+      }
+    ];
+  };
+in
+  lib.mkIf cfg.enable {
+    services.headscale = {
+      enable = true;
+      address = cfg.bind_host;
+      port = cfg.port;
+      settings = {
+        server_url = "https://${cfg.root_url}";
+
+        database.type = "sqlite";
+
+        dns = {
+          magic_dns = true;
+          base_domain = "collinux.tailnet";
+          override_local_dns = true;
+          nameservers.global = ["9.9.9.9" "149.112.112.112" "2620:fe::fe" "2620:fe::9"];
+        };
+
+        policy.path = "${acl_file}";
+
+        prefixes = {
+          "v4" = "100.100.0.0/16";
+          allocation = "random";
+        };
+
+        # leave tls for caddy to worry about
+        tls_cert_path = null;
+        tls_key_path = null;
+
+        logtail.enabled = false;
+      };
+    };
+
+    # make sure headscale can start before tailscale
+    systemd.services."headscale" = lib.mkIf config.collinux.services.networking.tailscale.enable {
+      after = lib.mkForce ["network.target"];
+      before = lib.mkForce ["headscale.target"];
+      wants = lib.mkForce ["network.target" "headscale.target"];
+    };
+
+    systemd.targets."headscale" = {
+      description = "Target represents headscale is running. started by headscale.service";
+    };
+
+    environment.systemPackages = [pkgs.headscale];
+
+    services.caddy = lib.mkIf cfg.caddy.enable {
+      virtualHosts.${cfg.root_url}.extraConfig = ''
+        ${
+          if cfg.caddy.bind_tailscale
+          then "bind tailscale/${cfg.service_name}"
+          else ""
+        }
+        reverse_proxy ${cfg.bind_host}:${toString cfg.port}
+      '';
+    };
+  }
diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix
index 2867d10..cfe7883 100644
--- a/modules/services/nixos/ssh.nix
+++ b/modules/services/nixos/ssh.nix
@@ -8,18 +8,32 @@ in {
   config = lib.mkIf cfg.enable {
     services.openssh = {
       enable = true;
+      openFirewall = false;
       hostKeys = [
         {
           path = "/etc/ssh/ssh_host_ed25519_key";
           type = "ed25519";
         }
       ];
+
+      listenAddresses = [
+        {
+          addr = cfg.bind_host;
+          port = 22;
+        }
+      ];
+
       settings = {
         PermitRootLogin = "prohibit-password";
         PasswordAuthentication = false;
       };
     };
 
+    systemd.services."openssh" = lib.mkIf config.collinux.services.networking.networkd.enable {
+      after = lib.mkAfter ["network-online.target"];
+      wants = lib.mkAfter ["network-online.target"];
+    };
+
     services.tailscale.extraSetFlags = lib.optional config.services.tailscale.enable "--ssh=true";
   };
 }
diff --git a/modules/services/nixos/tailscale.nix b/modules/services/nixos/tailscale.nix
index f39fc27..50e35d3 100644
--- a/modules/services/nixos/tailscale.nix
+++ b/modules/services/nixos/tailscale.nix
@@ -18,5 +18,17 @@ in
       allowedUDPPorts = [config.services.tailscale.port];
     };
 
+    # don't start tailscale until after headscale starts
+    systemd.services."tailscaled" =
+      if config.collinux.services.selfhost.headscale.enable
+      then {
+        wants = lib.mkForce ["network.target" "headscale.target"];
+        after = lib.mkForce ["network.target" "headscale.target"];
+      }
+      else {
+        wants = lib.mkForce ["network.target"];
+        after = lib.mkForce ["network.target"];
+      };
+
     environment.systemPackages = [pkgs.tailscale];
   }