nixos/britway: Add headscale
This commit is contained in:
@@ -1,6 +1,7 @@
|
||||
{ lib, ... }:
|
||||
let
|
||||
inherit (lib.my) net;
|
||||
inherit (lib.my.c) pubDomain;
|
||||
inherit (lib.my.c.britway) prefixes domain pubV4 assignedV6;
|
||||
in
|
||||
{
|
||||
@@ -39,6 +40,8 @@ in
|
||||
imports = [
|
||||
"${modulesPath}/profiles/qemu-guest.nix"
|
||||
./bgp.nix
|
||||
./nginx.nix
|
||||
./tailscale.nix
|
||||
];
|
||||
|
||||
config = mkMerge [
|
||||
|
||||
109
nixos/boxes/britway/nginx.nix
Normal file
109
nixos/boxes/britway/nginx.nix
Normal file
@@ -0,0 +1,109 @@
|
||||
{ lib, pkgs, config, ... }:
|
||||
let
|
||||
inherit (builtins) mapAttrs;
|
||||
inherit (lib) mkMerge mkDefault;
|
||||
inherit (lib.my.c) pubDomain;
|
||||
inherit (lib.my.c.nginx) baseHttpConfig proxyHeaders;
|
||||
in
|
||||
{
|
||||
config = {
|
||||
my = {
|
||||
secrets.files = {
|
||||
"dhparams.pem" = {
|
||||
owner = "acme";
|
||||
group = "acme";
|
||||
mode = "440";
|
||||
};
|
||||
"britway/cloudflare-credentials.conf" = {
|
||||
owner = "acme";
|
||||
group = "acme";
|
||||
};
|
||||
};
|
||||
|
||||
firewall = {
|
||||
tcp.allowed = [ "http" "https" ];
|
||||
};
|
||||
};
|
||||
|
||||
users = {
|
||||
users = {
|
||||
nginx.extraGroups = [ "acme" ];
|
||||
};
|
||||
};
|
||||
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults = {
|
||||
email = "dev@nul.ie";
|
||||
server = "https://acme-v02.api.letsencrypt.org/directory";
|
||||
reloadServices = [ "nginx" ];
|
||||
dnsResolver = "8.8.8.8";
|
||||
};
|
||||
certs = {
|
||||
"${pubDomain}" = {
|
||||
extraDomainNames = [
|
||||
"*.${pubDomain}"
|
||||
];
|
||||
dnsProvider = "cloudflare";
|
||||
credentialsFile = config.age.secrets."britway/cloudflare-credentials.conf".path;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
nginx = {
|
||||
enable = true;
|
||||
enableReload = true;
|
||||
|
||||
logError = "stderr info";
|
||||
recommendedTlsSettings = true;
|
||||
serverTokens = true;
|
||||
sslDhparam = config.age.secrets."dhparams.pem".path;
|
||||
|
||||
# Based on recommended*Settings, but probably better to be explicit about these
|
||||
appendHttpConfig = ''
|
||||
${baseHttpConfig}
|
||||
|
||||
# caching
|
||||
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=512m;
|
||||
'';
|
||||
|
||||
virtualHosts =
|
||||
let
|
||||
hosts = {
|
||||
"_" = {
|
||||
default = true;
|
||||
forceSSL = true;
|
||||
onlySSL = false;
|
||||
locations = {
|
||||
"/".root = "${pkgs.nginx}/html";
|
||||
};
|
||||
};
|
||||
|
||||
"ts.${pubDomain}" = {
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:${toString config.services.headscale.port}";
|
||||
proxyWebsockets = true;
|
||||
extraConfig = ''
|
||||
proxy_buffering off;
|
||||
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
defaultsFor = mapAttrs (n: _: {
|
||||
onlySSL = mkDefault true;
|
||||
useACMEHost = mkDefault pubDomain;
|
||||
kTLS = mkDefault true;
|
||||
http2 = mkDefault true;
|
||||
});
|
||||
in
|
||||
mkMerge [
|
||||
hosts
|
||||
(defaultsFor hosts)
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
82
nixos/boxes/britway/tailscale.nix
Normal file
82
nixos/boxes/britway/tailscale.nix
Normal file
@@ -0,0 +1,82 @@
|
||||
{ lib, pkgs, config, assignments, allAssignments, ... }:
|
||||
let
|
||||
inherit (lib.my.c) pubDomain;
|
||||
inherit (lib.my.c.britway) prefixes domain;
|
||||
|
||||
# Can't use overrideAttrs because we need to override `vendorHash` within `buildGoModule`
|
||||
headscale = pkgs.headscale.override {
|
||||
buildGoModule = args: pkgs.buildGoModule (args // rec {
|
||||
version = "0.23.0-alpha2";
|
||||
src = pkgs.fetchFromGitHub {
|
||||
owner = "juanfont";
|
||||
repo = "headscale";
|
||||
rev = "v${version}";
|
||||
hash = "sha256-sz+uQyyq/5YYDe5I44x5x2nvd48swAhNlInB8KZYvDo=";
|
||||
};
|
||||
vendorHash = "sha256-u9AmJguQ5dnJpfhOeLN43apvMHuraOrJhvlEIp9RoIc=";
|
||||
});
|
||||
};
|
||||
in
|
||||
{
|
||||
config = {
|
||||
environment.systemPackages = [
|
||||
# For CLI
|
||||
config.services.headscale.package
|
||||
];
|
||||
|
||||
services = {
|
||||
headscale = {
|
||||
enable = true;
|
||||
package = headscale;
|
||||
settings = {
|
||||
disable_check_updates = true;
|
||||
unix_socket_permission = "0770";
|
||||
server_url = "https://ts.${pubDomain}";
|
||||
db_type = "sqlite3";
|
||||
db_path = "/var/lib/headscale/db.sqlite3";
|
||||
noise.private_key_path = "/var/lib/headscale/noise_private.key";
|
||||
ip_prefixes = [
|
||||
"100.64.0.0/10"
|
||||
"fd7a:115c:a1e0::/48"
|
||||
];
|
||||
dns_config = {
|
||||
domains = [
|
||||
domain
|
||||
lib.my.c.colony.domain
|
||||
lib.my.c.home.domain
|
||||
];
|
||||
nameservers = [
|
||||
"1.1.1.1"
|
||||
"1.0.0.1"
|
||||
"2606:4700:4700::1111"
|
||||
"2606:4700:4700::1001"
|
||||
];
|
||||
magic_dns = true;
|
||||
base_domain = "ts.${pubDomain}";
|
||||
override_local_dns = true;
|
||||
};
|
||||
oidc = {
|
||||
only_start_if_oidc_is_available = true;
|
||||
issuer = "https://accounts.google.com";
|
||||
client_id = "545475967061-l45cln081mp8t4li2c34v7t7b8la6f4f.apps.googleusercontent.com";
|
||||
client_secret_path = config.age.secrets."britway/oidc-secret.txt".path;
|
||||
scope = [ "openid" "profile" "email" ];
|
||||
allowed_users = [ "jackos1998@gmail.com" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
my = {
|
||||
secrets = {
|
||||
files = {
|
||||
"britway/oidc-secret.txt" = {
|
||||
owner = "headscale";
|
||||
group = "headscale";
|
||||
mode = "440";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -2,6 +2,7 @@
|
||||
let
|
||||
inherit (lib.my) net;
|
||||
inherit (lib.my.c) pubDomain;
|
||||
inherit (lib.my.c.nginx) baseHttpConfig;
|
||||
inherit (lib.my.c.colony) domain prefixes;
|
||||
in
|
||||
{
|
||||
@@ -231,43 +232,7 @@ in
|
||||
|
||||
# Based on recommended*Settings, but probably better to be explicit about these
|
||||
appendHttpConfig = ''
|
||||
# NixOS provides a logrotate config that auto-compresses :)
|
||||
log_format main
|
||||
'$remote_addr - $remote_user [$time_local] $scheme "$host" "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
|
||||
access_log /var/log/nginx/access.log main;
|
||||
|
||||
# optimisation
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 65;
|
||||
|
||||
# gzip
|
||||
gzip on;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 5;
|
||||
gzip_types
|
||||
application/atom+xml
|
||||
application/javascript
|
||||
application/json
|
||||
application/xml
|
||||
application/xml+rss
|
||||
image/svg+xml
|
||||
text/css
|
||||
text/javascript
|
||||
text/plain
|
||||
text/xml;
|
||||
gzip_vary on;
|
||||
|
||||
# proxying
|
||||
proxy_buffering off;
|
||||
proxy_redirect off;
|
||||
proxy_connect_timeout 60s;
|
||||
proxy_read_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
${lib.my.c.nginx.proxyHeaders}
|
||||
${baseHttpConfig}
|
||||
|
||||
# caching
|
||||
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=4g;
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
let
|
||||
inherit (builtins) mapAttrs;
|
||||
inherit (lib) mkMerge mkIf mkDefault;
|
||||
inherit (lib.my.c.nginx) proxyHeaders;
|
||||
inherit (lib.my.c.nginx) baseHttpConfig proxyHeaders;
|
||||
inherit (lib.my.c.kelder) domain;
|
||||
in
|
||||
{
|
||||
@@ -39,43 +39,7 @@ in
|
||||
|
||||
# Based on recommended*Settings, but probably better to be explicit about these
|
||||
appendHttpConfig = ''
|
||||
# NixOS provides a logrotate config that auto-compresses :)
|
||||
log_format main
|
||||
'$remote_addr - $remote_user [$time_local] $scheme "$host" "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
|
||||
access_log /var/log/nginx/access.log main;
|
||||
|
||||
# optimisation
|
||||
sendfile on;
|
||||
tcp_nopush on;
|
||||
tcp_nodelay on;
|
||||
keepalive_timeout 65;
|
||||
|
||||
# gzip
|
||||
gzip on;
|
||||
gzip_proxied any;
|
||||
gzip_comp_level 5;
|
||||
gzip_types
|
||||
application/atom+xml
|
||||
application/javascript
|
||||
application/json
|
||||
application/xml
|
||||
application/xml+rss
|
||||
image/svg+xml
|
||||
text/css
|
||||
text/javascript
|
||||
text/plain
|
||||
text/xml;
|
||||
gzip_vary on;
|
||||
|
||||
# proxying
|
||||
proxy_buffering off;
|
||||
proxy_redirect off;
|
||||
proxy_connect_timeout 60s;
|
||||
proxy_read_timeout 60s;
|
||||
proxy_send_timeout 60s;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
${proxyHeaders}
|
||||
${baseHttpConfig}
|
||||
|
||||
# caching
|
||||
proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=CACHE:10m inactive=7d max_size=4g;
|
||||
|
||||
@@ -476,6 +476,7 @@ in
|
||||
}
|
||||
];
|
||||
})
|
||||
(persistSimpleSvc "headscale")
|
||||
]))
|
||||
]);
|
||||
|
||||
|
||||
@@ -38,7 +38,8 @@ in
|
||||
[ "wheel" "kvm" "dialout" ] ++
|
||||
(optional config.networking.networkmanager.enable "networkmanager") ++
|
||||
(optional config.virtualisation.libvirtd.enable "libvirtd") ++
|
||||
(optional config.programs.wireshark.enable "wireshark");
|
||||
(optional config.programs.wireshark.enable "wireshark") ++
|
||||
(with config.services.headscale; (optional enable group));
|
||||
password = mkIf (cfg.passwordSecret == null) (mkDefault "hunter2");
|
||||
shell =
|
||||
let shell = cfg.homeConfig.my.shell;
|
||||
|
||||
Reference in New Issue
Block a user