xyno/nix-configs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tailscale exit node

Browse source
This commit is contained in:
Philipp Hochkamp 2022-07-12 10:41:55 +02:00
parent ba7f19a5bf
commit 2e8589c3fa
2 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
hosts/ds9/default.nix
View file

@ -224,6 +224,8 @@ in
nginx.enable = true; nginx.enable = true;
jellyfin.enable = true; jellyfin.enable = true;
tailscale.enable = true; tailscale.enable = true;
tailscale.exitNode = true;
tailscale.extraUpCommands = "--advertise-routes=10.0.0.0/16";
grafana.enable = true; grafana.enable = true;
libvirt.enable = true; libvirt.enable = true;
paperless.enable = true; paperless.enable = true;

10
nixos-modules/networking/tailscale.nix
View file

@ -4,6 +4,8 @@ let
in in
{ {
options.ragon.services.tailscale.enable = lib.mkEnableOption "Enables tailscale"; options.ragon.services.tailscale.enable = lib.mkEnableOption "Enables tailscale";
options.ragon.services.tailscale.exitNode = lib.mkEnableOption "Exit Node";
options.ragon.services.tailscale.extraUpCommands = lib.my.mkOpt lib.types.str "";
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
# enable the tailscale service # enable the tailscale service
ragon.persist.extraDirectories = [ ragon.persist.extraDirectories = [
@ -11,10 +13,16 @@ in
]; ];
services.tailscale.enable = true; services.tailscale.enable = true;
ragon.agenix.secrets.tailscaleKey = { }; ragon.agenix.secrets.tailscaleKey = { };
boot.kernel.sysctl = lib.mkIf cfg.exitNode {
"net.ipv4.ip_forward" = 1;
"net.ipv6.conf.all.forwarding" = 1;
};
networking.firewall = { networking.firewall = {
# always allow traffic from your Tailscale network # always allow traffic from your Tailscale network
trustedInterfaces = [ "tailscale0" ]; trustedInterfaces = [ "tailscale0" ];
checkReversePath = lib.mkDefault "loose";
# allow the Tailscale UDP port through the firewall # allow the Tailscale UDP port through the firewall
allowedUDPPorts = [ config.services.tailscale.port ]; allowedUDPPorts = [ config.services.tailscale.port ];
}; };
@ -41,7 +49,7 @@ in
fi fi
key=$(<${config.age.secrets.tailscaleKey.path}) key=$(<${config.age.secrets.tailscaleKey.path})
# otherwise authenticate with tailscale # otherwise authenticate with tailscale
${tailscale}/bin/tailscale up -authkey $key ${tailscale}/bin/tailscale up -authkey $key ${lib.optionalString cfg.exitNode "--advertise-exit-node"} ${cfg.extraUpCommands}
''; '';
}; };
}; };