From 433ab8d024bfea7192f58d3e4ac7975885518606 Mon Sep 17 00:00:00 2001 From: SebastianStork Date: Wed, 19 Jun 2024 22:41:56 +0200 Subject: [PATCH] Enable tailscale --- hosts/inspiron/default.nix | 1 + hosts/inspiron/secrets.yaml | 5 +++-- hosts/north/default.nix | 4 ++++ hosts/north/secrets.yaml | 5 +++-- modules/system/default.nix | 1 + modules/system/tailscale.nix | 29 +++++++++++++++++++++++++++++ 6 files changed, 41 insertions(+), 4 deletions(-) create mode 100644 modules/system/tailscale.nix diff --git a/hosts/inspiron/default.nix b/hosts/inspiron/default.nix index e2e8ee4..d0a768b 100644 --- a/hosts/inspiron/default.nix +++ b/hosts/inspiron/default.nix @@ -29,6 +29,7 @@ nix-helper.enable = true; auto-gc.enable = true; night-light.enable = true; + tailscale.enable = true; }; boot.kernelPackages = pkgs.linuxPackages_latest; diff --git a/hosts/inspiron/secrets.yaml b/hosts/inspiron/secrets.yaml index 9fc0c15..cce53e9 100644 --- a/hosts/inspiron/secrets.yaml +++ b/hosts/inspiron/secrets.yaml @@ -1,4 +1,5 @@ seb-password: ENC[AES256_GCM,data:LlW1njlY0tVfYne/NFM2KJbAPb4eAQgy0mPMIZAIPH5mdr7cSCaPYhc+WF5ZlrlL//mh8WHhsHbEBuA6P7oabSeP6ZczCmTV6w==,iv:oWQj47oxjxR3DBHhFwUD/Emj5ziZHwcbXzD69ChRmHU=,tag:cuTloyd4HW6behF8fmWdxw==,type:str] +tailscale-auth-key: ENC[AES256_GCM,data:P63hQK6x6OjKQFZmoDXK2+ffUNd6wCzxot+d9GOsplbLMI1Dlvknt+Qq1GHaaziFgvGoQbLLha6RmORD1w==,iv:L9tKkJHuGuN6hzBcPum4giYInpn6+DuAq1zthTRSB/U=,tag:FDCnHCYY/vBYgf1xNiYyMg==,type:str] iwd: WLAN-233151: ENC[AES256_GCM,data:qnP47hqkVVAWycWaradtJQ/AUu6Jqhh281az4lHp9Vo6bmRLWNga2vG0Sg==,iv:+pC6EVtgzxR//bMJCDyzmsBrT25pcGZ5sAEkUkohU5Y=,tag:tAokgFEzr2S5B4UreB5lPA==,type:str] Fairphone4: ENC[AES256_GCM,data:BUSZHUxLNPCVc+h8VvcGo11ZHt04s7HVDOh0oaSOl/oB4dQ=,iv:YGbX6sF2FtjPwuGQGcQutWz7TD4Lg8DG0zi7ddXCkas=,tag:cNKu8xvrLOGy4Vq7WIBFTg==,type:str] @@ -26,8 +27,8 @@ sops: WlU1TjFDSHFzVU9TVWlNZVBJNkZabTQKkkgMlCEN84e1Syf9wB06CwToxZoE3CZi h369oefzYx06hEde06tU9UP7FtXRP0ktgZps4d+Fx4IkNJxoP6Ucuw== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-06-19T15:25:56Z" - mac: ENC[AES256_GCM,data:VZN7uHdsKBqb//CLjBjz5nKmd4rKClrFCcb6q+GizaYMqiitmmiT8GkLo0FRQnLUBPC8bR/Q6s9mDq9d2PxUxjFEpx122ndhkG0iOyMfDqNg2jx7XexkPoo8tAOnzX9qzOZ9NQbIVWYU6iuz0z0uTTBkiFV+lZW3NFB8gYf571M=,iv:lR5L0FU25XfEU6xBZNZCfl6I7cGAqvLvCTnCgGfw6fk=,tag:0jUeRx1B9byPVSzrmSOEUQ==,type:str] + lastmodified: "2024-06-19T20:13:42Z" + mac: ENC[AES256_GCM,data:VFOq0mHozaFdWgXYZgxzqFBpX798iXT+wLZh4ymMy0PCBcxG2iEbGkluHW+Z9GAZKeH6m34+XcpFqQ7TVHagLJ2yzf8LfUCjDdm6YFRcEfEmJ/TtGAoWxzzn+TW0oTgRn/nT1PboSf3QPCCaFrnNlcFidNQsaIGwlqGulDR6JUc=,iv:Bm9fIqesVgZ4/4TlghLE0N/IkctOhbKvbAKvXc9fQyQ=,tag:/ZNJOr0PTcMpbH7Hi5AwgA==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.8.1 diff --git a/hosts/north/default.nix b/hosts/north/default.nix index 10a3180..40c1ca8 100644 --- a/hosts/north/default.nix +++ b/hosts/north/default.nix @@ -25,6 +25,10 @@ nix-helper.enable = true; auto-gc.enable = true; night-light.enable = true; + tailscale = { + enable = true; + ssh.enable = true; + }; }; boot.kernelPackages = pkgs.linuxPackages_6_8; diff --git a/hosts/north/secrets.yaml b/hosts/north/secrets.yaml index 721c38f..ffc3c24 100644 --- a/hosts/north/secrets.yaml +++ b/hosts/north/secrets.yaml @@ -1,4 +1,5 @@ seb-password: ENC[AES256_GCM,data:vZml/awD9ieBCQQwYs9zZveqjDDzMxFH1PFKQ8qLlaiUgaWL2BmKf4RbuS/pkjNLHr/UkPM3d3rlW6WAlNvhZiMRE+naGwD1Mw==,iv:vORmRgBgZvdafRa8vFF4LL3fw44yZV3yNq3L8eOcQRI=,tag:B7jX2LV/vKpzFlvG0bnCVA==,type:str] +tailscale-auth-key: ENC[AES256_GCM,data:fFiUzrcS6KWhu+BjFgOfW9YmC/T7V4cebJT209lxScV6UKsUD6Pih5Kq7wOoajSH6fR+JorZwSowi6nXBg==,iv:0PEC9oOWrlZoALGu/KVD1dV1X3YVe9cIkiXWqoynxX8=,tag:ISyeO06FdgqoqNpi5jlg5w==,type:str] sops: kms: [] gcp_kms: [] @@ -23,8 +24,8 @@ sops: S04zMkpXT21GYTBSRFI2c1gyalZCK1UKtD6FA5BLLqnMAtVqYIujkM5qqMD524ck GipN/XwBhXSL98xrgaNmnN+Q46SNX0s41maGO624xvZMKZhObjxHIw== -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-06-19T15:25:19Z" - mac: ENC[AES256_GCM,data:0/Svom6EIyxR1mTOyFHMP6m1H7wO2s6VQNfLHtfQFoa3A7IC4gnqXR2yuro7Gf9C2mh8FIDwM3dxIHO+V0wpqQBdsYBEKPnaXSmAFHH9eZmF7FGHB6Y2V03/MyB0Iv1k5xWH77kkxMdeRxzkCYDyg1ADNbx/zvEHwTIEFsurSm4=,iv:e2+96ZKj0P5xv7jJfdxob3Hlr9THnnin4M+BIdSXBWU=,tag:5RR7eiLsQZlNBUjZ5qmEzw==,type:str] + lastmodified: "2024-06-19T20:13:00Z" + mac: ENC[AES256_GCM,data:J/g9kTpY0kpX0deHz8xNFxVHr+gBogkdHVQ0ri2AGZsDegn1y7MT89nQqKiRLysaJoQWSlEELhtBr4lph2pBcczWQZPUJ8tIDKeQaz6QsxKC88WkalgpG53YNRhar1B3BPoOmc22Kxj2p6xZQbbbth7HtK3//jgse3gDenLBqmQ=,iv:0BBZ0G47KzOirZ4ONtAEXlCfDkRHWZGDWoZv8eyZkBw=,tag:+YCOurwv6/efjRzeH+ZHSw==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.8.1 diff --git a/modules/system/default.nix b/modules/system/default.nix index 60347f3..c24b27a 100644 --- a/modules/system/default.nix +++ b/modules/system/default.nix @@ -15,5 +15,6 @@ ./nix-helper.nix ./auto-gc.nix ./night-light.nix + ./tailscale.nix ]; } diff --git a/modules/system/tailscale.nix b/modules/system/tailscale.nix new file mode 100644 index 0000000..9c5093d --- /dev/null +++ b/modules/system/tailscale.nix @@ -0,0 +1,29 @@ +{ config, lib, ... }: +let + cfg = config.myConfig.tailscale; +in +{ + options.myConfig.tailscale = { + enable = lib.mkEnableOption ""; + ssh.enable = lib.mkEnableOption ""; + exitNode.enable = lib.mkEnableOption ""; + }; + + config = lib.mkIf cfg.enable { + sops.secrets.tailscale-auth-key = { }; + + services.tailscale = { + enable = true; + + authKeyFile = config.sops.secrets.tailscale-auth-key.path; + openFirewall = true; + permitCertUid = "root"; + + useRoutingFeatures = if cfg.exitNode.enable then "server" else "client"; + extraUpFlags = [ + (lib.mkIf cfg.ssh.enable "--ssh") + (lib.mkIf cfg.exitNode.enable "--advertise-exit-node") + ]; + }; + }; +}