blob: 138553ae3d80c18ccca67c0ac10f24ef682466b5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
|
{ config, ... }:
let
domain = "headscale.sorre.xyz";
port = 5892;
in
{
imports = [ ./web/acme.nix ];
services.headscale = {
enable = true;
inherit port;
address = "127.0.0.1";
settings = {
server_url = "https://${domain}";
dns = {
base_domain = "sorre.internal";
nameservers.global = [ "1.1.1.1" "2301:db8:acad:a::1" ];
extra_records = [
{
name = "vaultwarden.sorre.internal";
type = "AAAA";
value = "100.64.0.3";
}
];
};
};
};
environment.systemPackages = [ config.services.headscale.package ];
services.nginx.virtualHosts."${domain}" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://localhost:${toString port}";
proxyWebsockets = true;
};
};
# also enable the tailscale client since this is a node too
services.tailscale = {
enable = true;
openFirewall = true;
};
networking.firewall = {
checkReversePath = "loose";
trustedInterfaces = [ "tailscale0" ];
allowedUDPPorts = [ config.services.tailscale.port ];
};
}
|
