Compare commits
6 Commits
9bf85c00cf
...
4dde4f68d8
Author | SHA1 | Date | |
---|---|---|---|
|
4dde4f68d8 | ||
|
aa9d2a5e03 | ||
|
6d51a10659 | ||
|
ccd57040df | ||
|
4eca8e4bb5 | ||
|
3840386d32 |
12
flake.lock
generated
12
flake.lock
generated
@ -24,11 +24,11 @@
|
|||||||
},
|
},
|
||||||
"nixos-unstable": {
|
"nixos-unstable": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1683893492,
|
"lastModified": 1684171979,
|
||||||
"narHash": "sha256-9sINNV7J26/afioFhS0vGrZ2zQHg1eBWE3lesBedyhI=",
|
"narHash": "sha256-KfIpmlqCCtY/T8mWQOkucv4LrYAgIXho6QJOwl2md3g=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "0ad4e41995ef6566cdd8477c132884411b7399a2",
|
"rev": "10092e14180fdff037aea3a14ad3faeaf6950ac1",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
@ -40,11 +40,11 @@
|
|||||||
},
|
},
|
||||||
"nixpkgs": {
|
"nixpkgs": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1683627095,
|
"lastModified": 1683928319,
|
||||||
"narHash": "sha256-8u9SejRpL2TrMuHBdhYh4FKc1OGPDLyWTpIbNTtoHsA=",
|
"narHash": "sha256-maz0DRKixJVcNRMiAMWlJniiF8IuQ+WbfmlJJ8D+jfM=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "a08e061a4ee8329747d54ddf1566d34c55c895eb",
|
"rev": "9656e85a15a0fe67847ee8cdb99a20d8df499962",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -42,7 +42,7 @@ in
|
|||||||
# ./runas.nix
|
# ./runas.nix
|
||||||
./tailscale.nix
|
./tailscale.nix
|
||||||
# ./searx.nix
|
# ./searx.nix
|
||||||
./plex.nix
|
#./plex.nix
|
||||||
./headscale.nix
|
./headscale.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
@ -117,6 +117,7 @@ in
|
|||||||
wlp4s0.useDHCP = false;
|
wlp4s0.useDHCP = false;
|
||||||
};
|
};
|
||||||
extraHosts = (generateDeviceStrings config.architect.networks.lan.devices) + ''
|
extraHosts = (generateDeviceStrings config.architect.networks.lan.devices) + ''
|
||||||
|
|
||||||
# Blacklist
|
# Blacklist
|
||||||
0.0.0.0 metrics.plex.tv
|
0.0.0.0 metrics.plex.tv
|
||||||
0.0.0.0 analytics.plex.tv
|
0.0.0.0 analytics.plex.tv
|
||||||
|
@ -18,7 +18,6 @@ in
|
|||||||
min-cache-ttl=120
|
min-cache-ttl=120
|
||||||
max-cache-ttl=2400
|
max-cache-ttl=2400
|
||||||
|
|
||||||
expand-hosts
|
|
||||||
domain=runas.rocks
|
domain=runas.rocks
|
||||||
domain=giugl.io
|
domain=giugl.io
|
||||||
domain=devs.runas.rocks
|
domain=devs.runas.rocks
|
||||||
|
@ -2,21 +2,12 @@
|
|||||||
|
|
||||||
let
|
let
|
||||||
domain = "vipienne.giugl.io";
|
domain = "vipienne.giugl.io";
|
||||||
|
|
||||||
utilities = import ./utilities.nix { inherit lib config; };
|
|
||||||
inherit (utilities) architectInterfaceAddress;
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
architect.firewall = {
|
architect.firewall = {
|
||||||
openTCP = [ config.services.headscale.port ];
|
openUDP = [ config.services.tailscale.port ];
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.extraHosts = ''
|
|
||||||
${architectInterfaceAddress "lan"} ${domain}
|
|
||||||
${architectInterfaceAddress "wireguard"} ${domain}
|
|
||||||
${architectInterfaceAddress "tailscale"} ${domain}
|
|
||||||
'';
|
|
||||||
|
|
||||||
environment.systemPackages = [ pkgs.unstablePkgs.headscale ];
|
environment.systemPackages = [ pkgs.unstablePkgs.headscale ];
|
||||||
|
|
||||||
services = {
|
services = {
|
||||||
@ -30,21 +21,12 @@ in
|
|||||||
settings = {
|
settings = {
|
||||||
dns_config = {
|
dns_config = {
|
||||||
magic_dns = true;
|
magic_dns = true;
|
||||||
domains = [
|
|
||||||
"giugl.io"
|
|
||||||
"runas.rocks"
|
|
||||||
"devs.giugl.io"
|
|
||||||
];
|
|
||||||
base_domain = "giugl.io";
|
base_domain = "giugl.io";
|
||||||
override_local_dns = true;
|
override_local_dns = true;
|
||||||
nameservers = [ config.architect.networks.tailscale.devices.architect.address ];
|
nameservers = [ config.architect.networks.tailscale.devices.architect.address ];
|
||||||
};
|
};
|
||||||
logtail.enabled = false;
|
logtail.enabled = false;
|
||||||
ip_prefixes = [ config.architect.networks.tailscale.net ];
|
ip_prefixes = [ config.architect.networks.tailscale.net ];
|
||||||
# The Noise private key is used to encrypt the
|
|
||||||
# traffic between headscale and Tailscale clients when
|
|
||||||
# using the new Noise-based protocol. It must be different
|
|
||||||
# from the legacy private key.
|
|
||||||
noise.private_key_path = "/var/lib/headscale/noise_private.key";
|
noise.private_key_path = "/var/lib/headscale/noise_private.key";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
@ -52,12 +34,19 @@ in
|
|||||||
nginx.virtualHosts.${domain} = {
|
nginx.virtualHosts.${domain} = {
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
|
extraConfig = ''
|
||||||
|
ssl_protocols TLSv1.2 TLSv1.3;
|
||||||
|
'';
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass =
|
proxyPass =
|
||||||
"http://127.0.0.1:${toString config.services.headscale.port}";
|
"http://127.0.0.1:${toString config.services.headscale.port}";
|
||||||
proxyWebsockets = true;
|
proxyWebsockets = true;
|
||||||
|
recommendedProxySettings = true;
|
||||||
|
extraConfig = ''
|
||||||
|
proxy_buffering off;
|
||||||
|
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
@ -1,4 +1,4 @@
|
|||||||
{ config, lib, ... }:
|
{ pkgs, config, lib, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
domain = "devs.giugl.io";
|
domain = "devs.giugl.io";
|
||||||
@ -8,8 +8,6 @@ let
|
|||||||
in
|
in
|
||||||
{
|
{
|
||||||
architect = {
|
architect = {
|
||||||
firewall.openUDP = [ config.services.tailscale.port ];
|
|
||||||
|
|
||||||
networks.tailscale = {
|
networks.tailscale = {
|
||||||
interface = "ts0";
|
interface = "ts0";
|
||||||
net = "100.64.0.0/10";
|
net = "100.64.0.0/10";
|
||||||
@ -31,6 +29,7 @@ in
|
|||||||
tailscale = {
|
tailscale = {
|
||||||
enable = true;
|
enable = true;
|
||||||
interfaceName = config.architect.networks.tailscale.interface;
|
interfaceName = config.architect.networks.tailscale.interface;
|
||||||
|
package = pkgs.unstablePkgs.tailscale;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user