From 547d6dc4731b04a240048b0b95c0ea12e0d1f6bd Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Fri, 9 Jan 2026 20:36:36 -0600
Subject: lots of changes, including revamp of network services boot chain on
 mercury

---
 modules/services/nixos/bluetooth.nix           | 12 ++++++++++++
 modules/services/nixos/networking/default.nix  |  3 +--
 modules/services/nixos/networking/networkd.nix |  6 ++++++
 modules/services/nixos/selfhost/adguard.nix    |  3 ++-
 modules/services/nixos/selfhost/forgejo.nix    |  7 ++++++-
 modules/services/nixos/selfhost/headscale.nix  | 25 +++++++++++++++++++------
 modules/services/nixos/ssh.nix                 | 14 ++++++++++++++
 modules/services/nixos/tailscale.nix           |  6 ++++++
 modules/services/options.nix                   |  4 +++-
 9 files changed, 69 insertions(+), 11 deletions(-)

(limited to 'modules')

diff --git a/modules/services/nixos/bluetooth.nix b/modules/services/nixos/bluetooth.nix
index a86b5b3..bdcaa00 100644
--- a/modules/services/nixos/bluetooth.nix
+++ b/modules/services/nixos/bluetooth.nix
@@ -12,6 +12,18 @@ in
       powerOnBoot = true;
     };
 
+    # hardening (down to 2.1 OK)
+    systemd.services."bluetooth".serviceConfig = {
+      IPAddressDeny = "any";
+      ProtectHostname = true;
+      ProtectKernelTunables = lib.mkForce true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = lib.mkForce true;
+      RestrictAddressFamilies = ["AF_UNIX" "AF_BLUETOOTH"];
+      ProtectClock = true;
+      ProcSubset = "pid";
+    };
+
     environment.systemPackages = [
       (lib.mkIf cfg.blueman.enable pkgs.blueman)
       (lib.mkIf cfg.bluetuith.enable pkgs.bluetuith)
diff --git a/modules/services/nixos/networking/default.nix b/modules/services/nixos/networking/default.nix
index 2667849..62b9146 100644
--- a/modules/services/nixos/networking/default.nix
+++ b/modules/services/nixos/networking/default.nix
@@ -11,6 +11,7 @@
   services.resolved = {
     enable = true;
     dnsovertls = "opportunistic";
+    dnssec = "allow-downgrade";
     fallbackDns = [
       "9.9.9.9#dns.quad9.net"
       "149.112.112.112#dns.quad9.net"
@@ -21,6 +22,4 @@
     extraConfig = "MulticastDNS=no";
   };
   networking.resolvconf.enable = false;
-
-  systemd.network.wait-online.enable = false;
 }
diff --git a/modules/services/nixos/networking/networkd.nix b/modules/services/nixos/networking/networkd.nix
index 9a11129..470bcec 100644
--- a/modules/services/nixos/networking/networkd.nix
+++ b/modules/services/nixos/networking/networkd.nix
@@ -25,6 +25,12 @@ in
 
     systemd.network = {
       enable = true;
+
+      wait-online = {
+        enable = true;
+        ignoredInterfaces = ["docker0"];
+      };
+
       networks."11-static-lan" = {
         name = "wl*";
 
diff --git a/modules/services/nixos/selfhost/adguard.nix b/modules/services/nixos/selfhost/adguard.nix
index c5e93ee..73c6caf 100644
--- a/modules/services/nixos/selfhost/adguard.nix
+++ b/modules/services/nixos/selfhost/adguard.nix
@@ -32,7 +32,8 @@ in
       DNSStubListener=no
     '';
 
-    services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
+    services.caddy = lib.mkIf (config.collinux.services.selfhost.caddy.enable
+      && config.collinux.services.selfhost.magic_caddy.enable) {
       virtualHosts.${cfg.root_url}.extraConfig = ''
         ${
           if config.collinux.services.networking.tailscale.enable
diff --git a/modules/services/nixos/selfhost/forgejo.nix b/modules/services/nixos/selfhost/forgejo.nix
index b1a6095..e499e64 100644
--- a/modules/services/nixos/selfhost/forgejo.nix
+++ b/modules/services/nixos/selfhost/forgejo.nix
@@ -36,7 +36,12 @@ in
       };
     };
 
-    services.caddy = lib.mkIf config.collinux.services.selfhost.caddy.enable {
+    systemd.services."forgejo" = lib.mkIf config.collinux.services.networking.networkd.enable {
+      after = lib.mkAfter ["network-online.target"];
+      wants = lib.mkAfter ["network-online.target"];
+    };
+
+    services.caddy = lib.mkIf (config.collinux.services.selfhost.caddy.enable && config.collinux.services.selfhost.magic_caddy.enable) {
       virtualHosts.${cfg.root_url}.extraConfig = ''
         ${
           if config.collinux.services.networking.tailscale.enable
diff --git a/modules/services/nixos/selfhost/headscale.nix b/modules/services/nixos/selfhost/headscale.nix
index 9319691..9989742 100644
--- a/modules/services/nixos/selfhost/headscale.nix
+++ b/modules/services/nixos/selfhost/headscale.nix
@@ -7,12 +7,14 @@
   cfg = config.collinux.services.selfhost.headscale;
 
   acl_file = (pkgs.formats.json {}).generate "acl.json" {
-    ssh = {
-      src = ["*"];
-      dst = ["*"];
-      users = ["autogroup:nonroot" "root"];
-      action = "accept";
-    };
+    ssh = [
+      {
+        src = ["collin@"];
+        dst = ["collin@"];
+        users = ["autogroup:nonroot" "root"];
+        action = "accept";
+      }
+    ];
   };
 in
   lib.mkIf cfg.enable {
@@ -47,6 +49,17 @@ in
       };
     };
 
+    # make sure headscale can start before tailscale
+    systemd.services."headscale" = lib.mkIf config.collinux.services.networking.tailscale.enable {
+      after = lib.mkForce ["network.target"];
+      before = lib.mkForce ["headscale.target"];
+      wants = lib.mkForce ["network.target" "headscale.target"];
+    };
+
+    systemd.targets."headscale" = {
+      description = "Target represents headscale is running. started by headscale.service";
+    };
+
     services.caddy.virtualHosts.${cfg.root_url}.extraConfig = lib.mkIf config.collinux.services.selfhost.caddy.enable ''
       reverse_proxy localhost:8080
     '';
diff --git a/modules/services/nixos/ssh.nix b/modules/services/nixos/ssh.nix
index 2867d10..cfe7883 100644
--- a/modules/services/nixos/ssh.nix
+++ b/modules/services/nixos/ssh.nix
@@ -8,18 +8,32 @@ in {
   config = lib.mkIf cfg.enable {
     services.openssh = {
       enable = true;
+      openFirewall = false;
       hostKeys = [
         {
           path = "/etc/ssh/ssh_host_ed25519_key";
           type = "ed25519";
         }
       ];
+
+      listenAddresses = [
+        {
+          addr = cfg.bind_host;
+          port = 22;
+        }
+      ];
+
       settings = {
         PermitRootLogin = "prohibit-password";
         PasswordAuthentication = false;
       };
     };
 
+    systemd.services."openssh" = lib.mkIf config.collinux.services.networking.networkd.enable {
+      after = lib.mkAfter ["network-online.target"];
+      wants = lib.mkAfter ["network-online.target"];
+    };
+
     services.tailscale.extraSetFlags = lib.optional config.services.tailscale.enable "--ssh=true";
   };
 }
diff --git a/modules/services/nixos/tailscale.nix b/modules/services/nixos/tailscale.nix
index f39fc27..6af3c1c 100644
--- a/modules/services/nixos/tailscale.nix
+++ b/modules/services/nixos/tailscale.nix
@@ -18,5 +18,11 @@ in
       allowedUDPPorts = [config.services.tailscale.port];
     };
 
+    # don't start tailscale until after headscale starts
+    systemd.services."tailscaled" = lib.mkIf config.collinux.services.selfhost.headscale.enable {
+      wants = lib.mkForce ["network.target" "headscale.target"];
+      after = lib.mkForce ["network.target" "headscale.target"];
+    };
+
     environment.systemPackages = [pkgs.tailscale];
   }
diff --git a/modules/services/options.nix b/modules/services/options.nix
index 2084c45..8be7c42 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -76,11 +76,13 @@ in {
             type = lib.types.str;
             default = with config.collinux.services.networking.tailscale;
               if enable
-              then "https://${service_name}.${tailnet}"
+              then "http://${service_name}.${tailnet}"
               else null;
           };
         };
       in {
+        magic_caddy.enable = mkEnableOption "Automatically create caddy configurations for services";
+
         adguard = selfhostOptions {
           service_name = "adguard";
           default_port = 8001;
-- 
cgit v1.3.1