Compare commits

..

6 Commits

Author SHA1 Message Date
Giulio De Pasquale
4dde4f68d8 Update lock 2023-05-15 19:50:51 +02:00
Giulio De Pasquale
aa9d2a5e03 tailscale: remove openUDP (moved to headscale) 2023-05-13 14:11:07 +02:00
Giulio De Pasquale
6d51a10659 headscale: DO NOT bind vipienne.giugl.io to avoid in-vpn lock 2023-05-13 14:10:40 +02:00
Giulio De Pasquale
ccd57040df tailscale: use unstable pkg 2023-05-13 00:54:24 +02:00
Giulio De Pasquale
4eca8e4bb5 plex: disabled 2023-05-13 00:53:17 +02:00
Giulio De Pasquale
3840386d32 dns: do not expand hosts 2023-05-13 00:53:03 +02:00
5 changed files with 19 additions and 31 deletions

12
flake.lock generated
View File

@ -24,11 +24,11 @@
},
"nixos-unstable": {
"locked": {
"lastModified": 1683893492,
"narHash": "sha256-9sINNV7J26/afioFhS0vGrZ2zQHg1eBWE3lesBedyhI=",
"lastModified": 1684171979,
"narHash": "sha256-KfIpmlqCCtY/T8mWQOkucv4LrYAgIXho6QJOwl2md3g=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "0ad4e41995ef6566cdd8477c132884411b7399a2",
"rev": "10092e14180fdff037aea3a14ad3faeaf6950ac1",
"type": "github"
},
"original": {
@ -40,11 +40,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1683627095,
"narHash": "sha256-8u9SejRpL2TrMuHBdhYh4FKc1OGPDLyWTpIbNTtoHsA=",
"lastModified": 1683928319,
"narHash": "sha256-maz0DRKixJVcNRMiAMWlJniiF8IuQ+WbfmlJJ8D+jfM=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "a08e061a4ee8329747d54ddf1566d34c55c895eb",
"rev": "9656e85a15a0fe67847ee8cdb99a20d8df499962",
"type": "github"
},
"original": {

View File

@ -42,7 +42,7 @@ in
# ./runas.nix
./tailscale.nix
# ./searx.nix
./plex.nix
#./plex.nix
./headscale.nix
];
@ -117,6 +117,7 @@ in
wlp4s0.useDHCP = false;
};
extraHosts = (generateDeviceStrings config.architect.networks.lan.devices) + ''
# Blacklist
0.0.0.0 metrics.plex.tv
0.0.0.0 analytics.plex.tv

View File

@ -18,7 +18,6 @@ in
min-cache-ttl=120
max-cache-ttl=2400
expand-hosts
domain=runas.rocks
domain=giugl.io
domain=devs.runas.rocks

View File

@ -2,21 +2,12 @@
let
domain = "vipienne.giugl.io";
utilities = import ./utilities.nix { inherit lib config; };
inherit (utilities) architectInterfaceAddress;
in
{
architect.firewall = {
openTCP = [ config.services.headscale.port ];
openUDP = [ config.services.tailscale.port ];
};
networking.extraHosts = ''
${architectInterfaceAddress "lan"} ${domain}
${architectInterfaceAddress "wireguard"} ${domain}
${architectInterfaceAddress "tailscale"} ${domain}
'';
environment.systemPackages = [ pkgs.unstablePkgs.headscale ];
services = {
@ -30,21 +21,12 @@ in
settings = {
dns_config = {
magic_dns = true;
domains = [
"giugl.io"
"runas.rocks"
"devs.giugl.io"
];
base_domain = "giugl.io";
override_local_dns = true;
nameservers = [ config.architect.networks.tailscale.devices.architect.address ];
};
logtail.enabled = false;
ip_prefixes = [ config.architect.networks.tailscale.net ];
# The Noise private key is used to encrypt the
# traffic between headscale and Tailscale clients when
# using the new Noise-based protocol. It must be different
# from the legacy private key.
noise.private_key_path = "/var/lib/headscale/noise_private.key";
};
};
@ -52,12 +34,19 @@ in
nginx.virtualHosts.${domain} = {
forceSSL = true;
enableACME = true;
extraConfig = ''
ssl_protocols TLSv1.2 TLSv1.3;
'';
locations."/" = {
proxyPass =
"http://127.0.0.1:${toString config.services.headscale.port}";
proxyWebsockets = true;
recommendedProxySettings = true;
extraConfig = ''
proxy_buffering off;
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
'';
};
};
};
}

View File

@ -1,4 +1,4 @@
{ config, lib, ... }:
{ pkgs, config, lib, ... }:
let
domain = "devs.giugl.io";
@ -8,8 +8,6 @@ let
in
{
architect = {
firewall.openUDP = [ config.services.tailscale.port ];
networks.tailscale = {
interface = "ts0";
net = "100.64.0.0/10";
@ -31,6 +29,7 @@ in
tailscale = {
enable = true;
interfaceName = config.architect.networks.tailscale.interface;
package = pkgs.unstablePkgs.tailscale;
};
};