SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 16:21:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Move secrets decryption from containers to server

Browse source
This commit is contained in:
SebastianStork 2024-09-22 19:10:52 +02:00
parent a4abd033cc
commit a7e1ced2a2
13 changed files with 58 additions and 196 deletions
Download patch file Download diff file Expand all files Collapse all files

6
modules/system/tailscale.nix
View file

@ -23,11 +23,13 @@ in
};
config = lib.mkIf cfg.enable {
sops.secrets."tailscale-auth-key" = { };
sops.secrets = lib.optionalAttrs config.myConfig.sops.enable {
"tailscale-auth-key" = { };
};
services.tailscale = {
enable = true;
authKeyFile = config.sops.secrets."tailscale-auth-key".path;
authKeyFile = config.sops.secrets."tailscale-auth-key".path or "/run/secrets/tailscale-auth-key";
openFirewall = true;
useRoutingFeatures = if (cfg.exitNode.enable || (cfg.serve != null)) then "server" else "client";
extraUpFlags = [ "--reset=true" ];