1 files changed, 114 insertions, 0 deletions
diff --git a/hosts/enode/headscale.nix b/hosts/enode/headscale.nix
new file mode 100644
index 0000000..d481917
--- /dev/null
+++ b/hosts/enode/headscale.nix
@@ -0,0 +1,114 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkIf
+    flip
+    ;
+
+  cfg = config.services.headscale;
+in
+{
+  services.headscale = {
+    enable = true;
+    address = "127.0.0.1";
+    port = 8080;
+    settings = {
+      server_url = "https://headscale.sorre.xyz";
+      database.sqlite = {
+        path = "/var/lib/headscale/db.sqlite";
+        write_ahead_log = true;
+      };
+      trusted_proxies = [
+        "127.0.0.1/32"
+        "::1/128"
+      ];
+      dns = {
+        base_domain = "sorre.internal";
+        override_local_dns = true;
+        nameservers.global = [
+          "1.1.1.1"
+          "1.0.0.1"
+        ];
+        magic_dns = true;
+        extra_records =
+          let
+            towerAddr = "100.0.0.6";
+            towerSubdomains = [
+              "music"
+              "vaultwarden"
+              "git"
+              "kanboard"
+            ];
+          in
+          flip map towerSubdomains (subdomain: {
+            type = "A";
+            name = "${subdomain}.${cfg.settings.dns.base_domain}";
+            value = towerAddr;
+          });
+      };
+      policy = {
+        mode = "file";
+        path = ./headscale-policy.json;
+      };
+    };
+  };
+
+  systemd.services.backup-headscale = mkIf cfg.enable {
+    serviceConfig = {
+      Type = "exec";
+      User = cfg.user;
+      Group = cfg.group;
+      StateDirectory = "backups/headscale";
+      StateDirectoryMode = "0700";
+      Umask = "077";
+    };
+    description = "Back up headscale data";
+    conflicts = [ "headscale.service" ];
+    path = [ pkgs.gnutar ];
+    enableStrictShellChecks = true;
+    script = ''
+      #!/usr/bin/env bash
+      set -euo pipefail
+
+      TIMESTAMP="$(date +%Y%m%d%H%M%S)"
+      BACKUP_PATH="$STATE_DIRECTORY/$TIMESTAMP.backup.tar"
+      echo "Backing up headscale to $BACKUP_PATH" >&2
+
+      tar cf "$BACKUP_PATH" /var/lib/headscale
+      chmod u=r,go-rwx "$BACKUP_PATH"
+
+      find "$STATE_DIRECTORY" -type f -name '*.backup.tar' -print0 |
+        sort --zero-terminated --reverse |
+        tail --zero-terminated --lines=+6 |
+        xargs --null --no-run-if-empty rm --
+    '';
+  };
+
+  # See: https://unix.stackexchange.com/a/804263
+  systemd.services.backup-headscale-restart-service = mkIf cfg.enable {
+    unitConfig = {
+      StopPropagatedFrom = "backup-headscale.service";
+      Before = "backup-headscale.service";
+      User = "root";
+    };
+    path = [ pkgs.systemdMinimal ];
+    serviceConfig = {
+      Type = "oneshot";
+      User = "root";
+      RemainAfterExit = true;
+      ExecStop = "systemctl start headscale.service";
+    };
+    wantedBy = [ "backup-headscale.service" ];
+  };
+
+  systemd.timers.backup-headscale = mkIf cfg.enable {
+    description = "Back up headscale every morning";
+    timerConfig.OnCalendar = "*-*-* 05:00:00";
+    wantedBy = [ "timers.target" ];
+  };
+}