commit 755081689173407879e840dc23057393a181401a
parent 0d070fa183b06d00211ce063faa693b234d7902b
Author: vin <vin@vineetk.net>
Date: Sun, 9 Mar 2025 01:54:51 -0500
hastur: add to tailnet
Diffstat:
3 files changed, 46 insertions(+), 15 deletions(-)
diff --git a/hosts/hastur/default.nix b/hosts/hastur/default.nix
@@ -11,6 +11,15 @@
home-manager.nixosModules.default
];
+ # decrypt agenix secrets
+ age.secrets = {
+ tailscale_hastur = {
+ file = ../../secrets/tailscale_hastur.age;
+ owner = "root";
+ group = "root";
+ };
+ };
+
# boot options
boot.loader.grub = {
enable = true;
@@ -58,22 +67,29 @@
# allowedUDPPorts = [ ];
};
- wg-quick.interfaces = {
- # mullvad to miami
- us-mia-wg-001 = {
- address = [
- "10.70.235.16/32"
- "fc00:bbbb:bbbb:bb01::7:eb0f/128"
- ];
-
- peers = [{
- allowedIPs = [ "0.0.0.0/0" "::0/0" ];
- endpoint = "45.134.142.219:51820";
- publicKey = "FVEKAMJqaJU2AwWn5Mg9TK9IAfJc4XDUmSzEeC/VXGs=";
- }];
+ # mullvad to miami
+ wg-quick.interfaces.us-mia-wg-001 = {
+ address = [
+ "10.70.235.16/32"
+ "fc00:bbbb:bbbb:bb01::7:eb0f/128"
+ ];
+ privateKey = "***REDACTED_WG_KEY***=";
+
+ # supposed to be done by tailscale instead \_(:/)_/
+ postUp = ''
+ ip route add 100.64.0.0/24 dev tailscale0
+ ip route add 100.100.100.100/32 dev tailscale0
+ '';
+ postDown = ''
+ ip route del 100.64.0.0/24 dev tailscale0
+ ip route del 100.100.100.100/32 dev tailscale0
+ '';
- privateKey = "***REDACTED_WG_KEY***=";
- };
+ peers = [{
+ allowedIPs = [ "0.0.0.0/0" "::0/0" ];
+ endpoint = "45.134.142.219:51820";
+ publicKey = "FVEKAMJqaJU2AwWn5Mg9TK9IAfJc4XDUmSzEeC/VXGs=";
+ }];
};
};
@@ -238,6 +254,18 @@ LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
pulse.enable = true;
};
+ # vpn
+ tailscale = {
+ enable = true;
+ authKeyFile = config.age.secrets.tailscale_hastur.path;
+ extraDaemonFlags = [ "--no-logs-no-support" ];
+ extraUpFlags = [
+ "--login-server=https://headscale.13f0.net"
+ "--advertise-exit-node"
+ ];
+ openFirewall = true;
+ };
+
# enable better power management
tlp.enable = true;
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
@@ -3,6 +3,7 @@ let
users = [ vin ];
demiurge = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICXDBcX7hXJCaKDRNaIAfycU83Y2J+uEB4wcALBOQpse";
+ hastur = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2ZUuPSPpIRULzMscBo5DJmA0UbFtG0jaANuzHo5aSQ";
saklas = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM7RCmfdgJKPnaBi336ZcvDWboxPj8lTtW1eDTN5qR2R";
systems = [ demiurge saklas ];
in
@@ -13,6 +14,8 @@ in
"hetzner_dns.age".publicKeys = users ++ [ saklas ];
"radicale_users.age".publicKeys = users ++ [ saklas ];
+
"tailscale_demiurge.age".publicKeys = users ++ [ demiurge ];
+ "tailscale_hastur.age".publicKeys = users ++ [ hastur ];
"tailscale_saklas.age".publicKeys = users ++ [ saklas ];
}
diff --git a/secrets/tailscale_hastur.age b/secrets/tailscale_hastur.age
Binary files differ.
