SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-22 00:21:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Configure tailscale docker sidecars for all containers at once

Browse source
This commit is contained in:
SebastianStork 2024-09-17 23:37:13 +02:00
parent 4db060800b
commit 490056a0d7
3 changed files with 52 additions and 71 deletions
Download patch file Download diff file Expand all files Collapse all files

45
hosts/stratus/containers/docker/onlyoffice/default.nix
View file

@ -2,12 +2,15 @@
let
serviceName = "onlyoffice";
subdomain = "office";
serveConfig = builtins.toJSON {
TCP."443".HTTPS = true;
Web."${subdomain}.${config.networking.domain}:443".Handlers."/".Proxy = "http://127.0.0.1:80";
};
configPath = pkgs.writeTextDir "tailscale-serve.json" serveConfig;
in
{
sops.secrets = {
"container/${serviceName}/tailscale-auth-key" = { };
"container/${serviceName}/jwt-secret" = { };
};
sops.secrets."container/${serviceName}/jwt-secret" = { };
virtualisation.oci-containers.containers = {
${serviceName} = {
@ -18,35 +21,9 @@ in
];
};
"tailscale-${serviceName}" =
let
configPath = pkgs.writeTextFile {
name = "config";
destination = "/tailscale-serve.json";
text = builtins.toJSON {
TCP."443".HTTPS = true;
Web."${subdomain}.${config.networking.domain}:443".Handlers."/".Proxy = "http://127.0.0.1:80";
};
};
in
{
image = "ghcr.io/tailscale/tailscale:latest";
environment = {
TS_HOSTNAME = subdomain;
TS_STATE_DIR = "/var/lib/tailscale";
TS_SERVE_CONFIG = "/config/tailscale-serve.json";
TS_USERSPACE = "true"; # https://github.com/tailscale/tailscale/issues/11372
};
environmentFiles = [
# Contains "TS_AUTHKEY=<token>"
config.sops.secrets."container/${serviceName}/tailscale-auth-key".path
];
volumes = [
"/var/lib/tailscale-${serviceName}:/var/lib/tailscale"
"${configPath}:/config"
];
extraOptions = [ "--network=container:${serviceName}" ];
dependsOn = [ serviceName ];
};
"tailscale-${serviceName}" = {
environment.TS_HOSTNAME = subdomain;
volumes = [ "${configPath}:/config" ];
};
};
}