peperunas/nixos
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

headscale: use architect options

Browse Source
This commit is contained in:
Giulio De Pasquale 2024-01-31 00:33:56 +01:00
parent 946e185c99
commit 7cf37954ef
1 changed files with 33 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
hosts/architect/headscale.nix
View File

@ -1,53 +1,46 @@
{ config, pkgs, lib, ... }: { config, pkgs, ... }:
let let
domain = "vipienne.giugl.io"; baseDomain = "giugl.io";
domain = "vipienne.${baseDomain}";
headscalePkg = pkgs.unstablePkgs.headscale;
in in
{ {
environment.systemPackages = [ pkgs.headscale ]; environment.systemPackages = [ headscalePkg ];
architect.firewall = { architect = {
firewall = {
openUDP = [ config.services.tailscale.port ]; openUDP = [ config.services.tailscale.port ];
}; };
services = { vhost.${domain} = {
headscale = { dnsInterfaces = [ "lan" "tailscale" ];
locations."/" = {
port = config.services.headscale.port;
allowWAN = true;
proxyWebsockets = true;
};
};
};
services.headscale = {
enable = true; enable = true;
package = pkgs.unstablePkgs.headscale; package = headscalePkg;
port = 1194;
address = "0.0.0.0";
settings = { settings = {
server_url = "https://${domain}"; server_url = "https://${domain}";
log.level = "debug"; log.level = "debug";
dns_config = { dns_config = {
magic_dns = true; magic_dns = false;
base_domain = "giugl.io"; base_domain = baseDomain;
override_local_dns = true; override_local_dns = true;
nameservers = [ config.architect.networks.tailscale.devices.architect.address ]; nameservers = [
config.architect.networks.tailscale.devices.architect.address
];
}; };
logtail.enabled = false; logtail.enabled = false;
ip_prefixes = [ config.architect.networks.tailscale.net ]; ip_prefixes = [ config.architect.networks.tailscale.net ];
noise.private_key_path = "/var/lib/headscale/noise_private.key"; noise.private_key_path = "/var/lib/headscale/noise_private.key";
}; };
}; };
nginx.virtualHosts.${domain} = {
forceSSL = true;
enableACME = true;
extraConfig = ''
ssl_protocols TLSv1.2 TLSv1.3;
'';
locations."/" = {
proxyPass =
"http://127.0.0.1:${toString config.services.headscale.port}";
proxyWebsockets = true;
recommendedProxySettings = true;
extraConfig = ''
proxy_buffering off;
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
'';
};
};
};
} }