SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 22:11:33 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add caddy module with tailscale integration

Browse source
This commit is contained in:
SebastianStork 2025-05-29 01:05:42 +02:00
parent 1f4b3e734b
commit e909dcd866
6 changed files with 164 additions and 147 deletions
Download patch file Download diff file Expand all files Collapse all files

89
modules/system/services/caddy.nix Normal file
View file

@ -0,0 +1,89 @@
{
config,
pkgs,
lib,
...
}:
let
caddyWithTailscale = pkgs.caddy.withPlugins {
plugins = [ "github.com/tailscale/caddy-tailscale@v0.0.0-20250207163903-69a970c84556" ];
hash = "sha256-wt3+xCsT83RpPySbL7dKVwgqjKw06qzrP2Em+SxEPto=";
};
allVirtualHosts =
config.custom.services.caddy.virtualHosts |> lib.filterAttrs (_: value: value.enable);
isTailscaleDomain = domain: domain |> lib.hasSuffix config.custom.services.tailscale.domain;
tailscaleHostsExist = lib.any (v: isTailscaleDomain v.domain) (lib.attrValues allVirtualHosts);
nonTailscaleHostsExist = lib.any (v: !isTailscaleDomain v.domain) (lib.attrValues allVirtualHosts);
getSubdomain = domain: domain |> lib.splitString "." |> lib.head;
in
{
options.custom.services.caddy.virtualHosts = lib.mkOption {
type = lib.types.attrsOf (
lib.types.submodule (
{ name, ... }:
{
options = {
enable = lib.mkOption {
type = lib.types.bool;
default = true;
};
domain = lib.mkOption {
type = lib.types.nonEmptyStr;
default = name;
};
port = lib.mkOption {
type = lib.types.port;
default = null;
};
};
}
)
);
default = { };
};
config = lib.mkIf (allVirtualHosts != { }) (
lib.mkMerge [
{
services.caddy = {
enable = true;
virtualHosts = lib.mapAttrs' (
_: v:
lib.nameValuePair v.domain {
extraConfig = lib.concatStrings [
(lib.optionalString (isTailscaleDomain v.domain) ''
bind tailscale/${getSubdomain v.domain}
tailscale_auth
'')
"reverse_proxy localhost:${toString v.port}"
];
}
) allVirtualHosts;
};
networking.firewall.allowedTCPPorts = lib.mkIf nonTailscaleHostsExist [
80
443
];
}
(lib.mkIf tailscaleHostsExist {
sops.secrets."service-tailscale-auth-key".owner = config.services.caddy.user;
services.caddy = {
package = caddyWithTailscale;
enableReload = false;
globalConfig = ''
tailscale {
auth_key {file.${config.sops.secrets."service-tailscale-auth-key".path}}
}
'';
};
})
]
);
}

66
modules/system/services/tailscale/caddy-serve.nix
View file

@ -1,66 +0,0 @@
{
config,
pkgs,
lib,
...
}:
let
nodes = config.custom.services.tailscale.caddyServe |> lib.filterAttrs (_: value: value.enable);
caddy-tailscale = pkgs.caddy.withPlugins {
plugins = [ "github.com/tailscale/caddy-tailscale@v0.0.0-20250207163903-69a970c84556" ];
hash = "sha256-wt3+xCsT83RpPySbL7dKVwgqjKw06qzrP2Em+SxEPto=";
};
in
{
options.custom.services.tailscale.caddyServe = lib.mkOption {
type = lib.types.attrsOf (
lib.types.submodule (
{ name, ... }:
{
options = {
enable = lib.mkEnableOption "" // {
default = true;
};
subdomain = lib.mkOption {
type = lib.types.nonEmptyStr;
default = name;
};
port = lib.mkOption {
type = lib.types.nullOr lib.types.port;
default = null;
};
};
}
)
);
default = { };
};
config = lib.mkIf (nodes != { }) {
sops.secrets."service-tailscale-auth-key".owner = config.services.caddy.user;
services.caddy = {
enable = true;
package = caddy-tailscale;
enableReload = false;
globalConfig = ''
tailscale {
auth_key {file.${config.sops.secrets."service-tailscale-auth-key".path}}
}
'';
virtualHosts = lib.mapAttrs' (
_: value:
lib.nameValuePair "https://${value.subdomain}.${config.custom.services.tailscale.domain}" {
extraConfig = ''
bind tailscale/${value.subdomain}
tailscale_auth
reverse_proxy localhost:${toString value.port}
'';
}
) nodes;
};
};
}

39
modules/system/services/tailscale/default.nix
View file

@ -1,9 +1,4 @@
{
config,
pkgs,
lib,
...
}:
{ config, lib, ... }:
let
cfg = config.custom.services.tailscale;
in
@ -16,13 +11,6 @@ in
};
ssh.enable = lib.mkEnableOption "";
exitNode.enable = lib.mkEnableOption "";
serve = {
isFunnel = lib.mkEnableOption "";
target = lib.mkOption {
type = lib.types.nullOr lib.types.nonEmptyStr;
default = null;
};
};
};
config = lib.mkIf cfg.enable {
@ -40,30 +28,5 @@ in
"--advertise-exit-node=${lib.boolToString cfg.exitNode.enable}"
];
};
systemd.services =
let
mode = if cfg.serve.isFunnel then "funnel" else "serve";
in
{
"tailscaled-${mode}" = lib.mkIf (cfg.serve.target != null) {
after = [
"tailscaled.service"
"tailscaled-autoconnect.service"
];
wants = [ "tailscaled.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStartPre = "${lib.getExe pkgs.tailscale} cert --min-validity 120h ${config.networking.hostName}.${cfg.domain}";
ExecStart = "${lib.getExe pkgs.tailscale} ${mode} --bg ${cfg.serve.target}";
ExecStop = "${lib.getExe pkgs.tailscale} ${mode} reset";
Restart = "on-failure";
};
};
tailscaled-set.after = [ "tailscaled-autoconnect.service" ];
};
};
}

45
modules/system/services/tailscale/serve-funnel.nix Normal file
View file

@ -0,0 +1,45 @@
{
config,
pkgs,
lib,
...
}:
let
cfg = config.custom.services.tailscale;
in
{
options.custom.services.tailscale.serve = {
isFunnel = lib.mkEnableOption "";
target = lib.mkOption {
type = lib.types.nullOr lib.types.nonEmptyStr;
default = null;
};
};
config = lib.mkIf cfg.enable {
systemd.services =
let
mode = if cfg.serve.isFunnel then "funnel" else "serve";
in
{
"tailscaled-${mode}" = lib.mkIf (cfg.serve.target != null) {
after = [
"tailscaled.service"
"tailscaled-autoconnect.service"
];
wants = [ "tailscaled.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStartPre = "${lib.getExe pkgs.tailscale} cert --min-validity 120h ${config.networking.hostName}.${cfg.domain}";
ExecStart = "${lib.getExe pkgs.tailscale} ${mode} --bg ${cfg.serve.target}";
ExecStop = "${lib.getExe pkgs.tailscale} ${mode} reset";
Restart = "on-failure";
};
};
tailscaled-set.after = [ "tailscaled-autoconnect.service" ];
};
};
}