peperunas/nixos
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

headscale: DO NOT bind vipienne.giugl.io to avoid in-vpn lock

Browse Source
This commit is contained in:
Giulio De Pasquale 2023-05-13 14:10:40 +02:00
parent ccd57040df
commit 6d51a10659
1 changed files with 9 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
hosts/architect/headscale.nix
View File

@ -2,21 +2,12 @@
let let
domain = "vipienne.giugl.io"; domain = "vipienne.giugl.io";
utilities = import ./utilities.nix { inherit lib config; };
inherit (utilities) architectInterfaceAddress;
in in
{ {
architect.firewall = { architect.firewall = {
openTCP = [ config.services.headscale.port ]; openUDP = [ config.services.tailscale.port ];
}; };
networking.extraHosts = ''
${architectInterfaceAddress "lan"} ${domain}
${architectInterfaceAddress "wireguard"} ${domain}
${architectInterfaceAddress "tailscale"} ${domain}
'';
environment.systemPackages = [ pkgs.unstablePkgs.headscale ]; environment.systemPackages = [ pkgs.unstablePkgs.headscale ];
services = { services = {
@ -30,21 +21,12 @@ in
settings = { settings = {
dns_config = { dns_config = {
magic_dns = true; magic_dns = true;
domains = [
"giugl.io"
"runas.rocks"
"devs.giugl.io"
];
base_domain = "giugl.io"; base_domain = "giugl.io";
override_local_dns = true; override_local_dns = true;
nameservers = [ config.architect.networks.tailscale.devices.architect.address ]; nameservers = [ config.architect.networks.tailscale.devices.architect.address ];
}; };
logtail.enabled = false; logtail.enabled = false;
ip_prefixes = [ config.architect.networks.tailscale.net ]; ip_prefixes = [ config.architect.networks.tailscale.net ];
# The Noise private key is used to encrypt the
# traffic between headscale and Tailscale clients when
# using the new Noise-based protocol. It must be different
# from the legacy private key.
noise.private_key_path = "/var/lib/headscale/noise_private.key"; noise.private_key_path = "/var/lib/headscale/noise_private.key";
}; };
}; };
@ -52,12 +34,19 @@ in
nginx.virtualHosts.${domain} = { nginx.virtualHosts.${domain} = {
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
extraConfig = ''
ssl_protocols TLSv1.2 TLSv1.3;
'';
locations."/" = { locations."/" = {
proxyPass = proxyPass =
"http://127.0.0.1:${toString config.services.headscale.port}"; "http://127.0.0.1:${toString config.services.headscale.port}";
proxyWebsockets = true; proxyWebsockets = true;
recommendedProxySettings = true;
extraConfig = ''
proxy_buffering off;
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
'';
}; };
}; };
}; };
} }