headscale: use architect options

hosts/architect/headscale.nix

@@ -1,53 +1,46 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, ... }:
 
 let
-  domain = "vipienne.giugl.io";
+  baseDomain = "giugl.io";
+  domain = "vipienne.${baseDomain}";
+  headscalePkg = pkgs.unstablePkgs.headscale;
 in
 {
-  environment.systemPackages = [ pkgs.headscale ];
+  environment.systemPackages = [ headscalePkg ];
 
-  architect.firewall = {
+  architect = {
+    firewall = {
       openUDP = [ config.services.tailscale.port ];
     };
 
-  services = {
-    headscale = {
+    vhost.${domain} = {
+      dnsInterfaces = [ "lan" "tailscale" ];
+      locations."/" = {
+        port = config.services.headscale.port;
+        allowWAN = true;
+        proxyWebsockets = true;
+      };
+    };
+  };
+
+  services.headscale = {
     enable = true;
-      package = pkgs.unstablePkgs.headscale;
-      port = 1194;
-      address = "0.0.0.0";
+    package = headscalePkg;
 
     settings = {
       server_url = "https://${domain}";
       log.level = "debug";
       dns_config = {
-          magic_dns = true;
-          base_domain = "giugl.io";
+        magic_dns = false;
+        base_domain = baseDomain;
         override_local_dns = true;
-          nameservers = [ config.architect.networks.tailscale.devices.architect.address ];
+        nameservers = [
+          config.architect.networks.tailscale.devices.architect.address
+        ];
       };
       logtail.enabled = false;
       ip_prefixes = [ config.architect.networks.tailscale.net ];
       noise.private_key_path = "/var/lib/headscale/noise_private.key";
     };
   };
-
-    nginx.virtualHosts.${domain} = {
-      forceSSL = true;
-      enableACME = true;
-      extraConfig = ''
-        ssl_protocols TLSv1.2 TLSv1.3;
-      '';
-      locations."/" = {
-        proxyPass =
-          "http://127.0.0.1:${toString config.services.headscale.port}";
-        proxyWebsockets = true;
-        recommendedProxySettings = true;
-        extraConfig = ''
-          proxy_buffering off;
-          add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
-        '';
-      };
-    };
-  };
 }