blob: 2bdcca15119124e416baa0a4672aaa9619c36bfd (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
{
config,
pkgs,
lib,
...
}: let
cfg = config.collinux.services.selfhost.headscale;
acl_file = (pkgs.formats.json {}).generate "acl.json" {
ssh = [
{
src = ["collin@"];
dst = ["collin@"];
users = ["autogroup:nonroot" "root"];
action = "accept";
}
];
};
in
lib.mkIf cfg.enable {
services.headscale = {
enable = true;
address = cfg.bind_host;
port = cfg.port;
settings = {
server_url = "https://${cfg.root_url}";
database.type = "sqlite";
dns = {
magic_dns = true;
base_domain = "collinux.tailnet";
override_local_dns = true;
nameservers.global = ["9.9.9.9" "149.112.112.112" "2620:fe::fe" "2620:fe::9"];
};
policy.path = "${acl_file}";
prefixes = {
"v4" = "100.100.0.0/16";
allocation = "random";
};
# leave tls for caddy to worry about
tls_cert_path = null;
tls_key_path = null;
logtail.enabled = false;
};
};
# make sure headscale can start before tailscale
systemd.services."headscale" = lib.mkIf config.collinux.services.networking.tailscale.enable {
after = lib.mkForce ["network.target"];
before = lib.mkForce ["headscale.target"];
wants = lib.mkForce ["network.target" "headscale.target"];
};
systemd.targets."headscale" = {
description = "Target represents headscale is running. started by headscale.service";
};
environment.systemPackages = [pkgs.headscale];
services.caddy = lib.mkIf cfg.caddy.enable {
virtualHosts.${cfg.root_url}.extraConfig = ''
${
if cfg.caddy.bind_tailscale
then "bind tailscale/${cfg.service_name}"
else ""
}
reverse_proxy ${cfg.bind_host}:${toString cfg.port}
'';
};
}
|
