config/profiles/vpn-pbsds/headscale.nix

76 lines
2.6 KiB
Nix
Raw Normal View History

2024-01-26 23:59:48 +01:00
{ lib, pkgs, config, ... }:
let
cfg = config.services.headscale;
server-url = "head.pbsds.net";
derpPort = 3478;
2024-01-27 03:47:28 +01:00
inherit (lib) mkIf getExe;
2024-01-26 23:59:48 +01:00
in
{
environment.systemPackages = mkIf cfg.enable [ cfg.package ];
services.headscale = {
enable = true;
address = "127.0.0.1";
port = 4987;
# https://github.com/juanfont/headscale/blob/main/config-example.yaml
# https://search.nixos.org/options?query=services.headscale.settings
settings = {
server_url = "https://${server-url}:443";
logtail.enabled = false;
log.level = "warn";
# https://tailscale.com/kb/1054/dns
dns_config.override_local_dns = true; # force clients to use our dns
#dns_config.nameservers = [ "1.1.1.1" ];
dns_config.magic_dns = true; # put our dns first in search
dns_config.domains = [ "ts.pbsds.net" ]; # search domains to inject into clients
dns_config.base_domain = "pbsds.net"; # clients become {hostname}.namespace.{base_domain}
# List of IP prefixes to allocate tailaddresses from.
ip_prefixes = [
"100.64.0.0/10"
"fd7a:115c:a1e0::/48"
];
# DERP is a relay system that Tailscale uses when a direct connection cannot be established.
# https://tailscale.com/blog/how-tailscale-works/#encrypted-tcp-relays-derp
# headscale needs a list of DERP servers that can be presented to the clients.
derp.server.enable = true; # run embedded DERP server
derp.server.region_id = 999;
derp.server.stun_listen_addr = "0.0.0.0:${toString derpPort}"; # UDP
#derp.server.private_key_path # autogenerated if it's missing.
#derp.urls = [] # List of externally available DERP maps
};
};
systemd.services."headscale-provisioning" = mkIf cfg.enable {
serviceConfig.Type = "oneshot";
after = [ "headscale.service" ];
wantedBy = [ "headscale.service" ];
script = ''
sleep 60 # Wait for headscale to be ready
2024-01-27 03:47:28 +01:00
${getExe cfg.package} namespaces create ts || true
2024-01-26 23:59:48 +01:00
'';
};
# The DERP server
networking.firewall.allowedUDPPorts = mkIf (cfg.enable && cfg.settings.derp.server.enable) [ derpPort ];
# https reverse proxy
networking.firewall.allowedTCPPorts = mkIf cfg.enable [ 80 443 ];
services.nginx.enable = mkIf cfg.enable true;
services.nginx.virtualHosts."${server-url}" = mkIf cfg.enable {
forceSSL = true; # addSSL = true;
enableACME = true; #useACMEHost = acmeDomain;
locations."/" = {
proxyPass = "http://localhost:${toString cfg.port}";
proxyWebsockets = true;
};
#locations."/metrics".proxyPass = "http://${cfg.settings.metrics_listen_addr}/metrics";
};
}