SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 22:11:33 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Enable tailscale

Browse source
This commit is contained in:
SebastianStork 2024-06-19 22:41:56 +02:00
parent 5fac577437
commit 433ab8d024
6 changed files with 41 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

1
hosts/inspiron/default.nix
View file

@ -29,6 +29,7 @@
nix-helper.enable = true; nix-helper.enable = true;
auto-gc.enable = true; auto-gc.enable = true;
night-light.enable = true; night-light.enable = true;
tailscale.enable = true;
}; };
boot.kernelPackages = pkgs.linuxPackages_latest; boot.kernelPackages = pkgs.linuxPackages_latest;

5
hosts/inspiron/secrets.yaml
View file

@ -1,4 +1,5 @@
seb-password: ENC[AES256_GCM,data:LlW1njlY0tVfYne/NFM2KJbAPb4eAQgy0mPMIZAIPH5mdr7cSCaPYhc+WF5ZlrlL//mh8WHhsHbEBuA6P7oabSeP6ZczCmTV6w==,iv:oWQj47oxjxR3DBHhFwUD/Emj5ziZHwcbXzD69ChRmHU=,tag:cuTloyd4HW6behF8fmWdxw==,type:str] seb-password: ENC[AES256_GCM,data:LlW1njlY0tVfYne/NFM2KJbAPb4eAQgy0mPMIZAIPH5mdr7cSCaPYhc+WF5ZlrlL//mh8WHhsHbEBuA6P7oabSeP6ZczCmTV6w==,iv:oWQj47oxjxR3DBHhFwUD/Emj5ziZHwcbXzD69ChRmHU=,tag:cuTloyd4HW6behF8fmWdxw==,type:str]
tailscale-auth-key: ENC[AES256_GCM,data:P63hQK6x6OjKQFZmoDXK2+ffUNd6wCzxot+d9GOsplbLMI1Dlvknt+Qq1GHaaziFgvGoQbLLha6RmORD1w==,iv:L9tKkJHuGuN6hzBcPum4giYInpn6+DuAq1zthTRSB/U=,tag:FDCnHCYY/vBYgf1xNiYyMg==,type:str]
iwd: iwd:
WLAN-233151: ENC[AES256_GCM,data:qnP47hqkVVAWycWaradtJQ/AUu6Jqhh281az4lHp9Vo6bmRLWNga2vG0Sg==,iv:+pC6EVtgzxR//bMJCDyzmsBrT25pcGZ5sAEkUkohU5Y=,tag:tAokgFEzr2S5B4UreB5lPA==,type:str] WLAN-233151: ENC[AES256_GCM,data:qnP47hqkVVAWycWaradtJQ/AUu6Jqhh281az4lHp9Vo6bmRLWNga2vG0Sg==,iv:+pC6EVtgzxR//bMJCDyzmsBrT25pcGZ5sAEkUkohU5Y=,tag:tAokgFEzr2S5B4UreB5lPA==,type:str]
Fairphone4: ENC[AES256_GCM,data:BUSZHUxLNPCVc+h8VvcGo11ZHt04s7HVDOh0oaSOl/oB4dQ=,iv:YGbX6sF2FtjPwuGQGcQutWz7TD4Lg8DG0zi7ddXCkas=,tag:cNKu8xvrLOGy4Vq7WIBFTg==,type:str] Fairphone4: ENC[AES256_GCM,data:BUSZHUxLNPCVc+h8VvcGo11ZHt04s7HVDOh0oaSOl/oB4dQ=,iv:YGbX6sF2FtjPwuGQGcQutWz7TD4Lg8DG0zi7ddXCkas=,tag:cNKu8xvrLOGy4Vq7WIBFTg==,type:str]
@ -26,8 +27,8 @@ sops:
WlU1TjFDSHFzVU9TVWlNZVBJNkZabTQKkkgMlCEN84e1Syf9wB06CwToxZoE3CZi WlU1TjFDSHFzVU9TVWlNZVBJNkZabTQKkkgMlCEN84e1Syf9wB06CwToxZoE3CZi
h369oefzYx06hEde06tU9UP7FtXRP0ktgZps4d+Fx4IkNJxoP6Ucuw== h369oefzYx06hEde06tU9UP7FtXRP0ktgZps4d+Fx4IkNJxoP6Ucuw==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2024-06-19T15:25:56Z" lastmodified: "2024-06-19T20:13:42Z"
mac: ENC[AES256_GCM,data:VZN7uHdsKBqb//CLjBjz5nKmd4rKClrFCcb6q+GizaYMqiitmmiT8GkLo0FRQnLUBPC8bR/Q6s9mDq9d2PxUxjFEpx122ndhkG0iOyMfDqNg2jx7XexkPoo8tAOnzX9qzOZ9NQbIVWYU6iuz0z0uTTBkiFV+lZW3NFB8gYf571M=,iv:lR5L0FU25XfEU6xBZNZCfl6I7cGAqvLvCTnCgGfw6fk=,tag:0jUeRx1B9byPVSzrmSOEUQ==,type:str] mac: ENC[AES256_GCM,data:VFOq0mHozaFdWgXYZgxzqFBpX798iXT+wLZh4ymMy0PCBcxG2iEbGkluHW+Z9GAZKeH6m34+XcpFqQ7TVHagLJ2yzf8LfUCjDdm6YFRcEfEmJ/TtGAoWxzzn+TW0oTgRn/nT1PboSf3QPCCaFrnNlcFidNQsaIGwlqGulDR6JUc=,iv:Bm9fIqesVgZ4/4TlghLE0N/IkctOhbKvbAKvXc9fQyQ=,tag:/ZNJOr0PTcMpbH7Hi5AwgA==,type:str]
pgp: [] pgp: []
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.8.1 version: 3.8.1

4
hosts/north/default.nix
View file

@ -25,6 +25,10 @@
nix-helper.enable = true; nix-helper.enable = true;
auto-gc.enable = true; auto-gc.enable = true;
night-light.enable = true; night-light.enable = true;
tailscale = {
enable = true;
ssh.enable = true;
};
}; };
boot.kernelPackages = pkgs.linuxPackages_6_8; boot.kernelPackages = pkgs.linuxPackages_6_8;

5
hosts/north/secrets.yaml
View file

@ -1,4 +1,5 @@
seb-password: ENC[AES256_GCM,data:vZml/awD9ieBCQQwYs9zZveqjDDzMxFH1PFKQ8qLlaiUgaWL2BmKf4RbuS/pkjNLHr/UkPM3d3rlW6WAlNvhZiMRE+naGwD1Mw==,iv:vORmRgBgZvdafRa8vFF4LL3fw44yZV3yNq3L8eOcQRI=,tag:B7jX2LV/vKpzFlvG0bnCVA==,type:str] seb-password: ENC[AES256_GCM,data:vZml/awD9ieBCQQwYs9zZveqjDDzMxFH1PFKQ8qLlaiUgaWL2BmKf4RbuS/pkjNLHr/UkPM3d3rlW6WAlNvhZiMRE+naGwD1Mw==,iv:vORmRgBgZvdafRa8vFF4LL3fw44yZV3yNq3L8eOcQRI=,tag:B7jX2LV/vKpzFlvG0bnCVA==,type:str]
tailscale-auth-key: ENC[AES256_GCM,data:fFiUzrcS6KWhu+BjFgOfW9YmC/T7V4cebJT209lxScV6UKsUD6Pih5Kq7wOoajSH6fR+JorZwSowi6nXBg==,iv:0PEC9oOWrlZoALGu/KVD1dV1X3YVe9cIkiXWqoynxX8=,tag:ISyeO06FdgqoqNpi5jlg5w==,type:str]
sops: sops:
kms: [] kms: []
gcp_kms: [] gcp_kms: []
@ -23,8 +24,8 @@ sops:
S04zMkpXT21GYTBSRFI2c1gyalZCK1UKtD6FA5BLLqnMAtVqYIujkM5qqMD524ck S04zMkpXT21GYTBSRFI2c1gyalZCK1UKtD6FA5BLLqnMAtVqYIujkM5qqMD524ck
GipN/XwBhXSL98xrgaNmnN+Q46SNX0s41maGO624xvZMKZhObjxHIw== GipN/XwBhXSL98xrgaNmnN+Q46SNX0s41maGO624xvZMKZhObjxHIw==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2024-06-19T15:25:19Z" lastmodified: "2024-06-19T20:13:00Z"
mac: ENC[AES256_GCM,data:0/Svom6EIyxR1mTOyFHMP6m1H7wO2s6VQNfLHtfQFoa3A7IC4gnqXR2yuro7Gf9C2mh8FIDwM3dxIHO+V0wpqQBdsYBEKPnaXSmAFHH9eZmF7FGHB6Y2V03/MyB0Iv1k5xWH77kkxMdeRxzkCYDyg1ADNbx/zvEHwTIEFsurSm4=,iv:e2+96ZKj0P5xv7jJfdxob3Hlr9THnnin4M+BIdSXBWU=,tag:5RR7eiLsQZlNBUjZ5qmEzw==,type:str] mac: ENC[AES256_GCM,data:J/g9kTpY0kpX0deHz8xNFxVHr+gBogkdHVQ0ri2AGZsDegn1y7MT89nQqKiRLysaJoQWSlEELhtBr4lph2pBcczWQZPUJ8tIDKeQaz6QsxKC88WkalgpG53YNRhar1B3BPoOmc22Kxj2p6xZQbbbth7HtK3//jgse3gDenLBqmQ=,iv:0BBZ0G47KzOirZ4ONtAEXlCfDkRHWZGDWoZv8eyZkBw=,tag:+YCOurwv6/efjRzeH+ZHSw==,type:str]
pgp: [] pgp: []
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.8.1 version: 3.8.1

1
modules/system/default.nix
View file

@ -15,5 +15,6 @@
./nix-helper.nix ./nix-helper.nix
./auto-gc.nix ./auto-gc.nix
./night-light.nix ./night-light.nix
./tailscale.nix
]; ];
} }

29
modules/system/tailscale.nix Normal file
View file

@ -0,0 +1,29 @@
{ config, lib, ... }:
let
cfg = config.myConfig.tailscale;
in
{
options.myConfig.tailscale = {
enable = lib.mkEnableOption "";
ssh.enable = lib.mkEnableOption "";
exitNode.enable = lib.mkEnableOption "";
};
config = lib.mkIf cfg.enable {
sops.secrets.tailscale-auth-key = { };
services.tailscale = {
enable = true;
authKeyFile = config.sops.secrets.tailscale-auth-key.path;
openFirewall = true;
permitCertUid = "root";
useRoutingFeatures = if cfg.exitNode.enable then "server" else "client";
extraUpFlags = [
(lib.mkIf cfg.ssh.enable "--ssh")
(lib.mkIf cfg.exitNode.enable "--advertise-exit-node")
];
};
};
}