xyno/nix-configs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tailscale exit node support

Browse source
This commit is contained in:
Lucy Hochkamp 2025-02-14 12:38:55 +01:00
parent b42a8d1c99
commit 0f2c8049fd
No known key found for this signature in database
5 changed files with 114 additions and 163 deletions
Download patch file Download diff file Expand all files Collapse all files

55
nixos-modules/networking/tailscale.nix
View file

@ -12,11 +12,12 @@ in
"/var/lib/tailscale"
];
services.tailscale.enable = true;
ragon.agenix.secrets.tailscaleKey = { };
boot.kernel.sysctl = lib.mkIf cfg.exitNode {
"net.ipv4.ip_forward" = 1;
"net.ipv6.conf.all.forwarding" = 1;
};
services.tailscale.useRoutingFeatures = "server";
# ragon.agenix.secrets.tailscaleKey = { };
# boot.kernel.sysctl = lib.mkIf cfg.exitNode {
# "net.ipv4.ip_forward" = 1;
# "net.ipv6.conf.all.forwarding" = 1;
# };
networking.firewall = {
# always allow traffic from your Tailscale network
trustedInterfaces = [ "tailscale0" ];
@ -26,31 +27,31 @@ in
# allow the Tailscale UDP port through the firewall
allowedUDPPorts = [ config.services.tailscale.port ];
};
systemd.services.tailscale-autoconnect = {
description = "Automatic connection to Tailscale";
# systemd.services.tailscale-autoconnect = {
# description = "Automatic connection to Tailscale";
# make sure tailscale is running before trying to connect to tailscale
after = [ "network-pre.target" "tailscale.service" ];
wants = [ "network-pre.target" "tailscale.service" ];
wantedBy = [ "multi-user.target" ];
# # make sure tailscale is running before trying to connect to tailscale
# after = [ "network-pre.target" "tailscale.service" ];
# wants = [ "network-pre.target" "tailscale.service" ];
# wantedBy = [ "multi-user.target" ];
# set this service as a oneshot job
serviceConfig.Type = "oneshot";
# # set this service as a oneshot job
# serviceConfig.Type = "oneshot";
# have the job run this shell script
script = with pkgs; ''
# wait for tailscaled to settle
sleep 2
# # have the job run this shell script
# script = with pkgs; ''
# # wait for tailscaled to settle
# sleep 2
# check if we are already authenticated to tailscale
status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
if [ $status = "Running" ]; then # if so, then do nothing
exit 0
fi
key=$(<${config.age.secrets.tailscaleKey.path})
# otherwise authenticate with tailscale
${tailscale}/bin/tailscale up -authkey $key ${lib.optionalString cfg.exitNode "--advertise-exit-node"} ${cfg.extraUpCommands}
'';
};
# # check if we are already authenticated to tailscale
# status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
# if [ $status = "Running" ]; then # if so, then do nothing
# exit 0
# fi
# key=$(<${config.age.secrets.tailscaleKey.path})
# # otherwise authenticate with tailscale
# ${tailscale}/bin/tailscale up -authkey $key ${lib.optionalString cfg.exitNode "--advertise-exit-node"} ${cfg.extraUpCommands}
# '';
# };
};
}