3 files changed, 78 insertions, 10 deletions
diff --git a/modules/services/nixos/selfhost/default.nix b/modules/services/nixos/selfhost/default.nix
index 876586d..de1078b 100644
--- a/modules/services/nixos/selfhost/default.nix
+++ b/modules/services/nixos/selfhost/default.nix
@@ -2,6 +2,7 @@
   imports = [
     ./adguard.nix
     ./forgejo.nix
+    ./headscale.nix
     ./caddy.nix
   ];
 }
diff --git a/modules/services/nixos/selfhost/headscale.nix b/modules/services/nixos/selfhost/headscale.nix
new file mode 100644
index 0000000..9319691
--- /dev/null
+++ b/modules/services/nixos/selfhost/headscale.nix
@@ -0,0 +1,55 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.services.selfhost.headscale;
+
+  acl_file = (pkgs.formats.json {}).generate "acl.json" {
+    ssh = {
+      src = ["*"];
+      dst = ["*"];
+      users = ["autogroup:nonroot" "root"];
+      action = "accept";
+    };
+  };
+in
+  lib.mkIf cfg.enable {
+    services.headscale = {
+      enable = true;
+      address = cfg.bind_host;
+      port = cfg.port;
+      settings = {
+        server_url = cfg.root_url;
+
+        database.type = "sqlite";
+
+        dns = {
+          magic_dns = true;
+          base_domain = "collinux.tailnet";
+          override_local_dns = true;
+          nameservers.global = ["9.9.9.9" "149.112.112.112" "2620:fe::fe" "2620:fe::9"];
+        };
+
+        policy.path = "${acl_file}";
+
+        prefixes = {
+          "v4" = "100.100.0.0/16";
+          allocation = "random";
+        };
+
+        # leave tls for caddy to worry about
+        tls_cert_path = null;
+        tls_key_path = null;
+
+        logtail.enabled = false;
+      };
+    };
+
+    services.caddy.virtualHosts.${cfg.root_url}.extraConfig = lib.mkIf config.collinux.services.selfhost.caddy.enable ''
+      reverse_proxy localhost:8080
+    '';
+
+    environment.systemPackages = [pkgs.headscale];
+  }
diff --git a/modules/services/options.nix b/modules/services/options.nix
index f42dd12..2084c45 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -31,8 +31,20 @@ in {
             default = null;
           };
         };
-        tailscale.enable = mkEnableOption "tailscale";
-        sshd.enable = mkEnableOption "OpenSSH server";
+        tailscale = {
+          enable = mkEnableOption "tailscale";
+          tailnet = mkOption {
+            type = lib.types.str;
+            default = "tail7cca06.ts.net";
+          };
+        };
+        sshd = {
+          enable = mkEnableOption "OpenSSH server";
+          bind_host = mkOption {
+            type = ip_addr;
+            default = "0.0.0.0";
+          };
+        };
       };
       audio = {
         enable = mkEnableOption "pipewire + wireplumber";
@@ -54,21 +66,17 @@ in {
           enable = mkEnableOption "";
           bind_host = mkOption {
             type = ip_addr;
-            default =
-              if config.collinux.services.networking.tailscale.enable
-              then "100.69.160.89"
-              else "0.0.0.0";
+            default = "0.0.0.0";
           };
           port = mkOption {
             type = lib.types.port;
             default = default_port;
           };
-
           root_url = mkOption {
             type = lib.types.str;
-            default =
-              if config.collinux.services.networking.tailscale.enable
-              then "https://${service_name}.tail7cca06.ts.net"
+            default = with config.collinux.services.networking.tailscale;
+              if enable
+              then "https://${service_name}.${tailnet}"
               else null;
           };
         };
@@ -81,6 +89,10 @@ in {
           service_name = "forgejo";
           default_port = 8010;
         };
+        headscale = selfhostOptions {
+          service_name = "headscale";
+          default_port = 8080;
+        };
         caddy = {
           enable = mkEnableOption "caddy https server";
           envFile = mkOption {