53 lines
1.3 KiB
Nix
53 lines
1.3 KiB
Nix
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
|
|
let
|
|
cfg = config.greg.tailscale;
|
|
tags = lib.concatMapStringsSep "," (s: "tag:${s}") cfg.tags;
|
|
in
|
|
{
|
|
options = {
|
|
greg.tailscale = {
|
|
enable = lib.mkEnableOption "Enable Tailscale";
|
|
|
|
hostname = lib.mkOption {
|
|
description = "Name on the tailnet to use";
|
|
default = config.networking.hostName;
|
|
type = lib.types.str;
|
|
};
|
|
|
|
tags = lib.mkOption {
|
|
type = lib.types.listOf lib.types.singleLineStr;
|
|
default = [ ];
|
|
description = "The tags to request for this node";
|
|
};
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
age.secrets.tailscale-key.file = ../../secrets/tailscale.age;
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.ip_forward" = "1";
|
|
"net.ipv6.conf.all.forwarding" = "1";
|
|
};
|
|
environment.systemPackages = [ config.services.tailscale.package ];
|
|
networking.firewall.checkReversePath = "loose";
|
|
services.tailscale = {
|
|
enable = true;
|
|
authKeyFile = config.age.secrets.tailscale-key.path;
|
|
authKeyParameters.preauthorized = true;
|
|
extraUpFlags = lib.optionals ((builtins.length cfg.tags) > 0) [
|
|
"--advertise-tags"
|
|
tags
|
|
];
|
|
useRoutingFeatures = "both";
|
|
};
|
|
systemd.services = {
|
|
tailscaled.partOf = [ "network-online.target" ];
|
|
};
|
|
};
|
|
}
|