blob: 6874ad1a80ff54a172275571b993367cc3a65a44 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
|
{ pkgs, config, ... }:
let
domain = "headscale.sorre.xyz";
port = 5892;
in
{
imports = [ ./web/acme.nix ];
services.headscale = {
enable = true;
inherit port;
address = "127.0.0.1";
settings = {
server_url = "https://${domain}";
dns = {
base_domain = "sorre.internal";
nameservers.global = [
"1.1.1.1"
"2301:db8:acad:a::1"
];
extra_records = [
{
name = "vaultwarden.sorre.internal";
type = "AAAA";
value = "100.64.0.3";
}
{
name = "git.sorre.internal";
type = "AAAA";
value = "100.64.0.3";
}
{
name = "music.sorre.internal";
type = "AAAA";
value = "100.64.0.3";
}
];
};
};
};
environment.systemPackages = [ config.services.headscale.package ];
services.nginx.virtualHosts."${domain}" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://localhost:${toString port}";
proxyWebsockets = true;
};
};
# also enable the tailscale client since this is a node too
services.tailscale = {
enable = true;
openFirewall = true;
};
networking.firewall = {
checkReversePath = "loose";
trustedInterfaces = [ "tailscale0" ];
allowedUDPPorts = [ config.services.tailscale.port ];
};
systemd.services.backup-headscale = {
serviceConfig.Type = "oneshot";
description = "Back up headscale data";
conflicts = [ "headscale.service" ];
path = [
pkgs.gnutar
pkgs.systemdMinimal
];
enableStrictShellChecks = true;
script = ''
#!/usr/bin/env bash
set -euo pipefail
[ ! -d /var/lib/backup/headscale ] && mkdir -p /var/lib/backup/headscale
TIMESTAMP="$(date +%Y%m%d%H%M%S)"
tar cvf "/var/lib/backup/headscale/$TIMESTAMP.backup.tar" /var/lib/headscale
find /var/lib/backup/headscale -type f -name '*.backup.tar' -print0 |
sort --zero-terminated --reverse |
tail --zero-terminated --lines=+6 |
xargs --null --no-run-if-empty rm --
'';
postStop = "systemctl start headscale.service";
};
systemd.timers.backup-headscale = {
description = "Back up headscale every morning";
timerConfig.OnCalendar = "*-*-* 05:00:00";
wantedBy = [ "timers.target" ];
};
}
|
