{ config, pkgs, lib, ... }: let domain = "vipienne.giugl.io"; in { environment.systemPackages = [ pkgs.headscale ]; architect.firewall = { openUDP = [ config.services.tailscale.port ]; }; services = { headscale = { enable = true; package = pkgs.unstablePkgs.headscale; port = 1194; address = "0.0.0.0"; settings = { server_url = "https://${domain}"; log.level = "debug"; dns_config = { magic_dns = true; base_domain = "giugl.io"; override_local_dns = true; nameservers = [ config.architect.networks.tailscale.devices.architect.address ]; }; logtail.enabled = false; ip_prefixes = [ config.architect.networks.tailscale.net ]; noise.private_key_path = "/var/lib/headscale/noise_private.key"; }; }; nginx.virtualHosts.${domain} = { forceSSL = true; enableACME = true; extraConfig = '' ssl_protocols TLSv1.2 TLSv1.3; ''; locations."/" = { proxyPass = "http://127.0.0.1:${toString config.services.headscale.port}"; proxyWebsockets = true; recommendedProxySettings = true; extraConfig = '' proxy_buffering off; add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always; ''; }; }; }; }