nixos/hosts/architect/headscale.nix

54 lines
1.4 KiB
Nix
Raw Normal View History

2023-05-12 13:28:39 +01:00
{ config, pkgs, lib, ... }:
2023-05-06 14:04:25 +01:00
let
domain = "vipienne.giugl.io";
in
{
architect.firewall = {
openUDP = [ config.services.tailscale.port ];
2023-05-06 14:04:25 +01:00
};
environment.systemPackages = [ pkgs.unstablePkgs.headscale ];
services = {
headscale = {
enable = true;
2023-05-27 23:16:46 +01:00
package = pkgs.headscale;
2023-05-06 14:04:25 +01:00
port = 1194;
address = "0.0.0.0";
2023-05-27 23:16:46 +01:00
2023-05-06 14:04:25 +01:00
settings = {
2023-05-27 23:16:46 +01:00
server_url = "https://${domain}";
log.level = "debug";
2023-05-06 14:04:25 +01:00
dns_config = {
magic_dns = true;
2023-05-12 13:28:39 +01:00
base_domain = "giugl.io";
2023-05-06 14:04:25 +01:00
override_local_dns = true;
2023-05-12 13:28:39 +01:00
nameservers = [ config.architect.networks.tailscale.devices.architect.address ];
2023-05-06 14:04:25 +01:00
};
logtail.enabled = false;
2023-05-12 13:28:39 +01:00
ip_prefixes = [ config.architect.networks.tailscale.net ];
2023-05-06 14:04:25 +01:00
noise.private_key_path = "/var/lib/headscale/noise_private.key";
};
};
nginx.virtualHosts.${domain} = {
forceSSL = true;
enableACME = true;
extraConfig = ''
ssl_protocols TLSv1.2 TLSv1.3;
'';
2023-05-06 14:04:25 +01:00
locations."/" = {
proxyPass =
"http://127.0.0.1:${toString config.services.headscale.port}";
proxyWebsockets = true;
recommendedProxySettings = true;
extraConfig = ''
proxy_buffering off;
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
'';
2023-05-06 14:04:25 +01:00
};
};
};
}