nixos-config

commit fa2ada494f30f290acf318dda05c34747f6de577
parent dd93de927f47cf894afb9c969954eb5fceb1fac7
Author: vin <vin@vineetk.net>
Date:   Mon,  3 Mar 2025 00:02:09 -0500

saklas, demiurge: finally get headscale working

Diffstat:
M
hosts/demiurge/default.nix
 | 
28
++++++++++++++++++++--------
M
hosts/saklas/default.nix
 | 
29
++++++++++++++++++++++++++++-

2 files changed, 48 insertions(+), 9 deletions(-)
diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
@@ -30,38 +30,44 @@
 
     firewall = {
       allowedTCPPorts = [ 22 80 443 ];
-      allowedUDPPorts = [ 51413 ];
+      allowedUDPPorts = [ 41641 51413 ];
     };
 
-    wg-quick.interfaces = {
+    wireguard.interfaces = {
       # vpn to vps
       wg0 = {
-        address = [ "10.0.13.2/24" ];
+        ips = [ "10.0.13.2/32" ];
+        privateKey = "***REMOVED***";
 
         peers = [{
           allowedIPs = [ "10.0.13.0/24" ];
           endpoint = "vineetk.net:51820";
           publicKey = "x3O4wISSau3DCrPRSplgGfSAizasbZAHzVqMR+WLzW4=";
           presharedKey = "***REMOVED***";
+          persistentKeepalive = 25;
         }];
-
-        privateKey = "***REMOVED***";
       };
 
       # mullvad to miami
       us-mia-wg-002 = {
-        address = [
+        ips = [
           "10.135.221.102/32"
           "fc00:bbbb:bbbb:bb01:d:0:7:dd66/128"
         ];
+        privateKey = "***REDACTED_WG_KEY***=";
+
+        postSetup = ''
+          ${pkgs.iproute2}/bin/ip route add 45.134.142.206 via 192.168.1.1
+        '';
+        postShutdown = ''
+          ${pkgs.iproute2}/bin/ip route delete 45.134.142.206 via 192.168.1.1
+        '';
 
         peers = [{
           allowedIPs = [ "0.0.0.0/0" "::0/0" ];
           endpoint = "45.134.142.206:51820";
           publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
         }];
-
-        privateKey = "***REDACTED_WG_KEY***=";
       };
     };
   };
@@ -788,6 +794,12 @@ LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
       };
     };
 
+    # vpn
+    tailscale = {
+      enable = true;
+      extraDaemonFlags = [ "--no-logs-no-support" ];
+    };
+
     # torrents
     transmission = {
       enable = true;
diff --git a/hosts/saklas/default.nix b/hosts/saklas/default.nix
@@ -15,7 +15,7 @@
 
     firewall = {
       allowedTCPPorts = [ 22 80 443 ];
-      allowedUDPPorts = [ 3478 51820 ];
+      allowedUDPPorts = [ 3478 41641 51820 ];
     };
 
     # VPN
@@ -122,6 +122,7 @@
   };
 
   security = {
+    # TLS
     acme = {
       acceptTerms = true;
 
@@ -153,6 +154,23 @@
   };
 
   services = {
+    # VPN
+    headscale = {
+      enable = true;
+      address = "127.0.0.1";
+      port = 8080;
+      settings = {
+        server_url = "https://headscale.13f0.net";
+        dns.base_domain = "headscale.13f0.net";
+        logtail.enabled = false;
+      };
+    };
+
+    tailscale = {
+      enable = true;
+      extraDaemonFlags = [ "--no-logs-no-support" ];
+    };
+
     # web server and reverse proxy
     nginx = {
       enable = true;
@@ -194,6 +212,15 @@
           };
         };
 
+        "headscale.13f0.net" = {
+          useACMEHost = "13f0.net";
+          forceSSL = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:8080";
+            proxyWebsockets = true;
+          };
+        };
+
         "vinbiz.ca" = {
           enableACME = true;
           forceSSL = true;