From 2b3d0f21ce7413bc85e0077bec1b4ddd3085f129 Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Mon, 3 Aug 2026 01:14:02 +0200
Subject: sagittarius: port more stuff to headscale

---
 hosts/sagittarius/headscale.nix | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

(limited to 'hosts/sagittarius/headscale.nix')

diff --git a/hosts/sagittarius/headscale.nix b/hosts/sagittarius/headscale.nix
index d605874..138553a 100644
--- a/hosts/sagittarius/headscale.nix
+++ b/hosts/sagittarius/headscale.nix
@@ -12,10 +12,20 @@ in
     address = "127.0.0.1";
     settings = {
       server_url = "https://${domain}";
-      dns.base_domain = "sorre.internal";
-      dns.nameservers.global = [ "1.1.1.1" "2301:db8:acad:a::1" ];
+      dns = {
+        base_domain = "sorre.internal";
+        nameservers.global = [ "1.1.1.1" "2301:db8:acad:a::1" ];
+        extra_records = [
+          {
+            name = "vaultwarden.sorre.internal";
+            type = "AAAA";
+            value = "100.64.0.3";
+          }
+        ];
+      };
     };
   };
+  environment.systemPackages = [ config.services.headscale.package ];
 
   services.nginx.virtualHosts."${domain}" = {
     forceSSL = true;
@@ -26,5 +36,14 @@ in
     };
   };
 
-  environment.systemPackages = [ config.services.headscale.package ];
+  # also enable the tailscale client since this is a node too
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;
+  };
+  networking.firewall = {
+    checkReversePath = "loose";
+    trustedInterfaces = [ "tailscale0" ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
+  };
 }
-- 
cgit v1.3.1