dev/nixfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

nixos/britway: Setup split DNS
All checks were successful
CI / Check, build and cache Nix flake (push) Successful in 19m27s
Details

Browse Source
This commit is contained in:
Jack O'Sullivan 2023-12-20 16:43:20 +00:00
parent b2342c7a05
commit 46df9b8aa8
1 changed files with 19 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
nixos/boxes/britway/tailscale.nix
View File

@ -24,6 +24,12 @@ let
lib.my.c.home.prefixes.all.v4 lib.my.c.home.prefixes.all.v4
lib.my.c.home.prefixes.all.v6 lib.my.c.home.prefixes.all.v6
]; ];
pubNameservers = [
"1.1.1.1"
"1.0.0.1"
"2606:4700:4700::1111"
"2606:4700:4700::1001"
];
in in
{ {
config = { config = {
@ -45,20 +51,19 @@ in
noise.private_key_path = "/var/lib/headscale/noise_private.key"; noise.private_key_path = "/var/lib/headscale/noise_private.key";
ip_prefixes = with lib.my.c.tailscale.prefix; [ v4 v6 ]; ip_prefixes = with lib.my.c.tailscale.prefix; [ v4 v6 ];
dns_config = { dns_config = {
domains = [ restricted_nameservers = {
domain "${domain}" = pubNameservers;
lib.my.c.colony.domain "${lib.my.c.colony.domain}" = with allAssignments.estuary.internal; [
lib.my.c.home.domain ipv4.address ipv6.address
]; ];
nameservers = [ "${lib.my.c.home.domain}" = lib.my.c.home.routersPubV4 ++ ([
"1.1.1.1" allAssignments.river.as211024.ipv6.address
"1.0.0.1" allAssignments.stream.as211024.ipv6.address
"2606:4700:4700::1111" ]);
"2606:4700:4700::1001" };
];
magic_dns = true; magic_dns = true;
base_domain = "ts.${pubDomain}"; base_domain = "ts.${pubDomain}";
override_local_dns = true; override_local_dns = false;
}; };
oidc = { oidc = {
only_start_if_oidc_is_available = true; only_start_if_oidc_is_available = true;
@ -77,7 +82,9 @@ in
openFirewall = true; openFirewall = true;
interfaceName = "tailscale0"; interfaceName = "tailscale0";
extraUpFlags = [ extraUpFlags = [
"--operator=${config.my.user.config.name}"
"--login-server=https://ts.nul.ie" "--login-server=https://ts.nul.ie"
"--netfilter-mode=off"
"--advertise-exit-node" "--advertise-exit-node"
"--advertise-routes=${advRoutes}" "--advertise-routes=${advRoutes}"
]; ];