nixos/hosts/architect/headscale.nix

{ config, pkgs, lib, ... }:

let
  domain = "vipienne.giugl.io";
in
{
  architect.firewall = {
    openUDP = [ config.services.tailscale.port ];
  };

  environment.systemPackages = [ pkgs.unstablePkgs.headscale ];

  services = {
    headscale = {
      enable = true;
      package = pkgs.headscale;
      port = 1194;
      address = "0.0.0.0";

      settings = {
        server_url = "https://${domain}";
        log.level = "debug";
        dns_config = {
          magic_dns = true;
          base_domain = "giugl.io";
          override_local_dns = true;
          nameservers = [ config.architect.networks.tailscale.devices.architect.address ];
        };
        logtail.enabled = false;
        ip_prefixes = [ config.architect.networks.tailscale.net ];
        noise.private_key_path = "/var/lib/headscale/noise_private.key";
      };
    };

    nginx.virtualHosts.${domain} = {
      forceSSL = true;
      enableACME = true;
      extraConfig = ''
        ssl_protocols TLSv1.2 TLSv1.3;
      '';
      locations."/" = {
        proxyPass =
          "http://127.0.0.1:${toString config.services.headscale.port}";
        proxyWebsockets = true;
        recommendedProxySettings = true;
        extraConfig = ''
          proxy_buffering off;
          add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
        '';
      };
    };
  };
}