SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 19:51:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Tailscale funnel hedgedoc

Browse source
This commit is contained in:
SebastianStork 2025-04-11 17:29:48 +02:00
parent 005c01fe21
commit 7c545ad442
2 changed files with 34 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

28
hosts/alto/default.nix
View file

@ -1,7 +1,6 @@
{ config, ... }: { config, ... }:
let let
inherit (config) myConfig; inherit (config) myConfig;
inherit (myConfig.tailscale) caddyServe;
in in
{ {
system.stateVersion = "24.11"; system.stateVersion = "24.11";
@ -13,28 +12,25 @@ in
enable = true; enable = true;
ssh.enable = true; ssh.enable = true;
exitNode.enable = true; exitNode.enable = true;
serve = {
isFunnel = true;
target = "localhost:${toString myConfig.hedgedoc.port}";
};
caddyServe.nextcloud = {
inherit (myConfig.nextcloud) subdomain port;
};
};
caddyServe = {
nextcloud = { nextcloud = {
enable = true;
backups.enable = true;
subdomain = "cloud"; subdomain = "cloud";
inherit (myConfig.nextcloud) port;
};
hedgedoc = {
subdomain = "docs";
inherit (myConfig.hedgedoc) port;
};
};
};
nextcloud = {
enable = true;
backups.enable = true;
inherit (caddyServe.nextcloud) subdomain;
}; };
hedgedoc = { hedgedoc = {
enable = true; enable = true;
backups.enable = true; backups.enable = true;
inherit (caddyServe.hedgedoc) subdomain; subdomain = config.networking.hostName;
}; };
}; };
} }

27
modules/system/tailscale/default.nix
View file

@ -16,11 +16,14 @@ in
}; };
ssh.enable = lib.mkEnableOption ""; ssh.enable = lib.mkEnableOption "";
exitNode.enable = lib.mkEnableOption ""; exitNode.enable = lib.mkEnableOption "";
serve = lib.mkOption { serve = {
isFunnel = lib.mkEnableOption "";
target = lib.mkOption {
type = lib.types.nullOr lib.types.nonEmptyStr; type = lib.types.nullOr lib.types.nonEmptyStr;
default = null; default = null;
}; };
}; };
};
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
sops.secrets."tailscale-auth-key" = { }; sops.secrets."tailscale-auth-key" = { };
@ -29,7 +32,8 @@ in
enable = true; enable = true;
authKeyFile = config.sops.secrets."tailscale-auth-key".path; authKeyFile = config.sops.secrets."tailscale-auth-key".path;
openFirewall = true; openFirewall = true;
useRoutingFeatures = if (cfg.exitNode.enable || (cfg.serve != null)) then "server" else "client"; useRoutingFeatures =
if (cfg.exitNode.enable || (cfg.serve.target != null)) then "server" else "client";
extraUpFlags = [ "--reset=true" ]; extraUpFlags = [ "--reset=true" ];
extraSetFlags = [ extraSetFlags = [
"--hostname=${cfg.subdomain}" "--hostname=${cfg.subdomain}"
@ -38,9 +42,12 @@ in
]; ];
}; };
systemd.services.tailscaled-set.after = [ "tailscaled-autoconnect.service" ]; systemd.services =
let
systemd.services.tailscaled-serve = lib.mkIf (cfg.serve != null) { mode = if cfg.serve.isFunnel then "funnel" else "serve";
in
{
"tailscaled-${mode}" = lib.mkIf (cfg.serve.target != null) {
after = [ after = [
"tailscaled.service" "tailscaled.service"
"tailscaled-autoconnect.service" "tailscaled-autoconnect.service"
@ -48,11 +55,11 @@ in
wants = [ "tailscaled.service" ]; wants = [ "tailscaled.service" ];
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot"; serviceConfig.Type = "oneshot";
script = '' preStart = "${lib.getExe pkgs.tailscale} cert --min-validity 120h ${cfg.subdomain}.${config.networking.domain}";
${lib.getExe pkgs.tailscale} cert --min-validity 120h ${cfg.subdomain}.${config.networking.domain} script = "${lib.getExe pkgs.tailscale} ${mode} ${cfg.serve.target}";
${lib.getExe pkgs.tailscale} serve reset };
${lib.getExe pkgs.tailscale} serve --bg ${cfg.serve}
''; tailscaled-set.after = [ "tailscaled-autoconnect.service" ];
}; };
}; };
} }