Compare commits

...

6 Commits

Author SHA1 Message Date
Giulio De Pasquale
4dde4f68d8 Update lock 2023-05-15 19:50:51 +02:00
Giulio De Pasquale
aa9d2a5e03 tailscale: remove openUDP (moved to headscale) 2023-05-13 14:11:07 +02:00
Giulio De Pasquale
6d51a10659 headscale: DO NOT bind vipienne.giugl.io to avoid in-vpn lock 2023-05-13 14:10:40 +02:00
Giulio De Pasquale
ccd57040df tailscale: use unstable pkg 2023-05-13 00:54:24 +02:00
Giulio De Pasquale
4eca8e4bb5 plex: disabled 2023-05-13 00:53:17 +02:00
Giulio De Pasquale
3840386d32 dns: do not expand hosts 2023-05-13 00:53:03 +02:00
5 changed files with 19 additions and 31 deletions

12
flake.lock generated
View File

@ -24,11 +24,11 @@
}, },
"nixos-unstable": { "nixos-unstable": {
"locked": { "locked": {
"lastModified": 1683893492, "lastModified": 1684171979,
"narHash": "sha256-9sINNV7J26/afioFhS0vGrZ2zQHg1eBWE3lesBedyhI=", "narHash": "sha256-KfIpmlqCCtY/T8mWQOkucv4LrYAgIXho6QJOwl2md3g=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "0ad4e41995ef6566cdd8477c132884411b7399a2", "rev": "10092e14180fdff037aea3a14ad3faeaf6950ac1",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -40,11 +40,11 @@
}, },
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1683627095, "lastModified": 1683928319,
"narHash": "sha256-8u9SejRpL2TrMuHBdhYh4FKc1OGPDLyWTpIbNTtoHsA=", "narHash": "sha256-maz0DRKixJVcNRMiAMWlJniiF8IuQ+WbfmlJJ8D+jfM=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "a08e061a4ee8329747d54ddf1566d34c55c895eb", "rev": "9656e85a15a0fe67847ee8cdb99a20d8df499962",
"type": "github" "type": "github"
}, },
"original": { "original": {

View File

@ -42,7 +42,7 @@ in
# ./runas.nix # ./runas.nix
./tailscale.nix ./tailscale.nix
# ./searx.nix # ./searx.nix
./plex.nix #./plex.nix
./headscale.nix ./headscale.nix
]; ];
@ -117,6 +117,7 @@ in
wlp4s0.useDHCP = false; wlp4s0.useDHCP = false;
}; };
extraHosts = (generateDeviceStrings config.architect.networks.lan.devices) + '' extraHosts = (generateDeviceStrings config.architect.networks.lan.devices) + ''
# Blacklist # Blacklist
0.0.0.0 metrics.plex.tv 0.0.0.0 metrics.plex.tv
0.0.0.0 analytics.plex.tv 0.0.0.0 analytics.plex.tv

View File

@ -18,7 +18,6 @@ in
min-cache-ttl=120 min-cache-ttl=120
max-cache-ttl=2400 max-cache-ttl=2400
expand-hosts
domain=runas.rocks domain=runas.rocks
domain=giugl.io domain=giugl.io
domain=devs.runas.rocks domain=devs.runas.rocks

View File

@ -2,21 +2,12 @@
let let
domain = "vipienne.giugl.io"; domain = "vipienne.giugl.io";
utilities = import ./utilities.nix { inherit lib config; };
inherit (utilities) architectInterfaceAddress;
in in
{ {
architect.firewall = { architect.firewall = {
openTCP = [ config.services.headscale.port ]; openUDP = [ config.services.tailscale.port ];
}; };
networking.extraHosts = ''
${architectInterfaceAddress "lan"} ${domain}
${architectInterfaceAddress "wireguard"} ${domain}
${architectInterfaceAddress "tailscale"} ${domain}
'';
environment.systemPackages = [ pkgs.unstablePkgs.headscale ]; environment.systemPackages = [ pkgs.unstablePkgs.headscale ];
services = { services = {
@ -30,21 +21,12 @@ in
settings = { settings = {
dns_config = { dns_config = {
magic_dns = true; magic_dns = true;
domains = [
"giugl.io"
"runas.rocks"
"devs.giugl.io"
];
base_domain = "giugl.io"; base_domain = "giugl.io";
override_local_dns = true; override_local_dns = true;
nameservers = [ config.architect.networks.tailscale.devices.architect.address ]; nameservers = [ config.architect.networks.tailscale.devices.architect.address ];
}; };
logtail.enabled = false; logtail.enabled = false;
ip_prefixes = [ config.architect.networks.tailscale.net ]; ip_prefixes = [ config.architect.networks.tailscale.net ];
# The Noise private key is used to encrypt the
# traffic between headscale and Tailscale clients when
# using the new Noise-based protocol. It must be different
# from the legacy private key.
noise.private_key_path = "/var/lib/headscale/noise_private.key"; noise.private_key_path = "/var/lib/headscale/noise_private.key";
}; };
}; };
@ -52,12 +34,19 @@ in
nginx.virtualHosts.${domain} = { nginx.virtualHosts.${domain} = {
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
extraConfig = ''
ssl_protocols TLSv1.2 TLSv1.3;
'';
locations."/" = { locations."/" = {
proxyPass = proxyPass =
"http://127.0.0.1:${toString config.services.headscale.port}"; "http://127.0.0.1:${toString config.services.headscale.port}";
proxyWebsockets = true; proxyWebsockets = true;
recommendedProxySettings = true;
extraConfig = ''
proxy_buffering off;
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
'';
}; };
}; };
}; };
} }

View File

@ -1,4 +1,4 @@
{ config, lib, ... }: { pkgs, config, lib, ... }:
let let
domain = "devs.giugl.io"; domain = "devs.giugl.io";
@ -8,8 +8,6 @@ let
in in
{ {
architect = { architect = {
firewall.openUDP = [ config.services.tailscale.port ];
networks.tailscale = { networks.tailscale = {
interface = "ts0"; interface = "ts0";
net = "100.64.0.0/10"; net = "100.64.0.0/10";
@ -31,6 +29,7 @@ in
tailscale = { tailscale = {
enable = true; enable = true;
interfaceName = config.architect.networks.tailscale.interface; interfaceName = config.architect.networks.tailscale.interface;
package = pkgs.unstablePkgs.tailscale;
}; };
}; };