modules/services/nixos/headscale.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69

{
  config,
  pkgs,
  lib,
  ...
}: let
  cfg = config.collinux.services.headscale;

  acl_file = (pkgs.formats.json {}).generate "acl.json" {
    ssh = [
      {
        src = ["collin@"];
        dst = ["collin@"];
        users = ["autogroup:nonroot" "root"];
        action = "accept";
      }
    ];
  };
in {
  imports = [
    (import ./mkCaddyCfg.nix cfg)
  ];

  config = lib.mkIf cfg.enable {
    services.headscale = {
      enable = true;
      address = cfg.bind_host;
      port = cfg.port;
      settings = {
        server_url = "https://${cfg.root_url}";

        database.type = "sqlite";

        dns = {
          magic_dns = true;
          base_domain = "collinux.tailnet";
          override_local_dns = true;
          nameservers.global = ["9.9.9.9" "149.112.112.112" "2620:fe::fe" "2620:fe::9"];
        };

        policy.path = acl_file;

        prefixes = {
          "v4" = "100.100.0.0/16";
          allocation = "random";
        };

        # leave tls for caddy to worry about
        tls_cert_path = null;
        tls_key_path = null;

        logtail.enabled = false;
      };
    };

    # make sure headscale can start before tailscale
    systemd.services."headscale" = lib.mkIf config.collinux.system.networking.tailscale.enable {
      after = lib.mkForce ["network.target"];
      before = lib.mkForce ["headscale.target"];
      wants = lib.mkForce ["network.target" "headscale.target"];
    };

    systemd.targets."headscale" = {
      description = "Target represents headscale is running. started by headscale.service";
    };

    environment.systemPackages = [pkgs.headscale];
  };
}