SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 17:31:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Refactor container configuration

Browse source
This commit is contained in:
SebastianStork 2024-09-02 13:33:44 +02:00
parent 8af96429ff
commit 380d8202ff
15 changed files with 288 additions and 241 deletions
Download patch file Download diff file Expand all files Collapse all files

15
modules/system/sops.nix
View file

@ -5,15 +5,24 @@
lib,
...
}:
let
cfg = config.myConfig.sops;
in
{
imports = [ inputs.sops-nix.nixosModules.sops ];
options.myConfig.sops.enable = lib.mkEnableOption "";
options.myConfig.sops = {
enable = lib.mkEnableOption "";
defaultSopsFile = lib.mkOption {
type = lib.types.path;
default = "${self}/hosts/${config.networking.hostName}/secrets.yaml";
};
};
config = lib.mkIf config.myConfig.sops.enable {
config = lib.mkIf cfg.enable {
sops = {
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
defaultSopsFile = "${self}/hosts/${config.networking.hostName}/secrets.yaml";
inherit (cfg) defaultSopsFile;
};
};
}

30
modules/system/tailscale.nix
View file

@ -1,4 +1,9 @@
{ config, lib, ... }:
{
config,
pkgs,
lib,
...
}:
let
cfg = config.myConfig.tailscale;
in
@ -7,16 +12,20 @@ in
enable = lib.mkEnableOption "";
ssh.enable = lib.mkEnableOption "";
exitNode.enable = lib.mkEnableOption "";
serve = lib.mkOption {
type = lib.types.nullOr lib.types.nonEmptyStr;
default = null;
};
};
config = lib.mkIf cfg.enable {
sops.secrets.tailscale-auth-key.restartUnits = [ "tailscaled-autoconnect.service" ];
sops.secrets.tailscale-auth-key = { };
services.tailscale = {
enable = true;
authKeyFile = config.sops.secrets.tailscale-auth-key.path;
openFirewall = true;
useRoutingFeatures = if cfg.exitNode.enable then "server" else "client";
useRoutingFeatures = if (cfg.exitNode.enable || (cfg.serve != null)) then "server" else "client";
extraUpFlags = [ "--reset=true" ];
extraSetFlags = [
"--ssh=${lib.boolToString cfg.ssh.enable}"
@ -25,5 +34,20 @@ in
};
systemd.services.tailscaled-set.after = [ "tailscaled-autoconnect.service" ];
systemd.services.tailscale-serve = lib.mkIf (cfg.serve != null) {
after = [
"tailscaled.service"
"tailscaled-autoconnect.service"
];
wants = [ "tailscaled.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot";
script = ''
${lib.getExe pkgs.tailscale} cert ${config.networking.fqdn}
${lib.getExe pkgs.tailscale} serve reset
${lib.getExe pkgs.tailscale} serve --bg ${cfg.serve}
'';
};
};
}