Update lock

flake.lock

@@ -24,11 +24,11 @@
     },
     "nixos-unstable": {
       "locked": {
-        "lastModified": 1683893492,
-        "narHash": "sha256-9sINNV7J26/afioFhS0vGrZ2zQHg1eBWE3lesBedyhI=",
+        "lastModified": 1684171979,
+        "narHash": "sha256-KfIpmlqCCtY/T8mWQOkucv4LrYAgIXho6QJOwl2md3g=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0ad4e41995ef6566cdd8477c132884411b7399a2",
+        "rev": "10092e14180fdff037aea3a14ad3faeaf6950ac1",
         "type": "github"
       },
       "original": {
@@ -40,11 +40,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1683627095,
-        "narHash": "sha256-8u9SejRpL2TrMuHBdhYh4FKc1OGPDLyWTpIbNTtoHsA=",
+        "lastModified": 1683928319,
+        "narHash": "sha256-maz0DRKixJVcNRMiAMWlJniiF8IuQ+WbfmlJJ8D+jfM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a08e061a4ee8329747d54ddf1566d34c55c895eb",
+        "rev": "9656e85a15a0fe67847ee8cdb99a20d8df499962",
         "type": "github"
       },
       "original": {

hosts/architect/default.nix

@@ -42,7 +42,7 @@ in
     #    ./runas.nix
     ./tailscale.nix
     #    ./searx.nix
-    ./plex.nix
+    #./plex.nix
     ./headscale.nix
   ];
 
@@ -117,6 +117,7 @@ in
       wlp4s0.useDHCP = false;
     };
     extraHosts = (generateDeviceStrings config.architect.networks.lan.devices) + ''
+
       # Blacklist
       0.0.0.0                metrics.plex.tv
       0.0.0.0                analytics.plex.tv

hosts/architect/dns.nix

@@ -18,7 +18,6 @@ in
         min-cache-ttl=120
         max-cache-ttl=2400
 
-        expand-hosts
         domain=runas.rocks
         domain=giugl.io
         domain=devs.runas.rocks

hosts/architect/headscale.nix

@@ -2,21 +2,12 @@
 
 let
   domain = "vipienne.giugl.io";
-  
-  utilities = import ./utilities.nix { inherit lib config; };
-  inherit (utilities) architectInterfaceAddress;
 in
 {
   architect.firewall = {
-    openTCP = [ config.services.headscale.port ];
+    openUDP = [ config.services.tailscale.port ];
   };
 
-  networking.extraHosts = ''
-    ${architectInterfaceAddress "lan"} ${domain}
-    ${architectInterfaceAddress "wireguard"} ${domain}
-    ${architectInterfaceAddress "tailscale"} ${domain}
-  '';
-
   environment.systemPackages = [ pkgs.unstablePkgs.headscale ];
 
   services = {
@@ -30,21 +21,12 @@ in
       settings = {
         dns_config = {
           magic_dns = true;
-          domains = [
-            "giugl.io"
-            "runas.rocks"
-            "devs.giugl.io"
-          ];
           base_domain = "giugl.io";
           override_local_dns = true;
           nameservers = [ config.architect.networks.tailscale.devices.architect.address ];
         };
         logtail.enabled = false;
         ip_prefixes = [ config.architect.networks.tailscale.net ];
-        # The Noise private key is used to encrypt the
-        # traffic between headscale and Tailscale clients when
-        # using the new Noise-based protocol. It must be different
-        # from the legacy private key.
         noise.private_key_path = "/var/lib/headscale/noise_private.key";
       };
     };
@@ -52,12 +34,19 @@ in
     nginx.virtualHosts.${domain} = {
       forceSSL = true;
       enableACME = true;
+      extraConfig = ''
+        ssl_protocols TLSv1.2 TLSv1.3;
+      '';
       locations."/" = {
         proxyPass =
           "http://127.0.0.1:${toString config.services.headscale.port}";
         proxyWebsockets = true;
+        recommendedProxySettings = true;
+        extraConfig = ''
+          proxy_buffering off;
+          add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+        '';
       };
     };
-
   };
 }

hosts/architect/tailscale.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ pkgs, config, lib, ... }:
 
 let
   domain = "devs.giugl.io";
@@ -8,8 +8,6 @@ let
 in
 {
   architect = {
-    firewall.openUDP = [ config.services.tailscale.port ];
-
     networks.tailscale = {
       interface = "ts0";
       net = "100.64.0.0/10";
@@ -31,6 +29,7 @@ in
     tailscale = {
       enable = true;
       interfaceName = config.architect.networks.tailscale.interface;
+      package = pkgs.unstablePkgs.tailscale;
     };
   };