modules/services/nixos/tailscale.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

{
  config,
  pkgs,
  lib,
  ...
}: let
  cfg = config.collinux.services.networking.tailscale;
in
  lib.mkIf cfg.enable {
    services.tailscale = {
      enable = true;
      useRoutingFeatures = "both";
    };

    networking.firewall = {
      checkReversePath = "loose";
      trustedInterfaces = ["tailscale0"];
      allowedUDPPorts = [config.services.tailscale.port];
    };

    # don't start tailscale until after headscale starts
    systemd.services."tailscaled" =
      if config.collinux.services.selfhost.headscale.enable
      then {
        wants = lib.mkForce ["network.target" "headscale.target"];
        after = lib.mkForce ["network.target" "headscale.target"];
      }
      else {
        wants = lib.mkForce ["network.target"];
        after = lib.mkForce ["network.target"];
      };

    environment.systemPackages = [pkgs.tailscale];
  }