Setup headscale

machines/lasting-integrity/default.nix

@@ -67,6 +67,7 @@
     services = {
       garmin-scraper.enable = true;
       grafana.enable = true;
+      headscale.enable = true;
       mail.enable = true;
       mastodon.enable = true;
       matrix.enable = true;

modules/base/network/default.nix

@@ -4,5 +4,8 @@
   imports = [
     ./ovh.nix
     ./mobile.nix
+    ./tailscale.nix
   ];
+
+  networking.firewall.checkReversePath = "loose";
 }

modules/base/network/tailscale.nix

@@ -0,0 +1,3 @@
+{ ... }: {
+  services.tailscale.enable = true;
+}

modules/services/default.nix

@@ -8,6 +8,7 @@
     ./deluge
     ./garmin-scraper
     ./grafana
+    ./headscale
     ./mail
     ./mastodon
     ./matrix

modules/services/headscale/default.nix

@@ -0,0 +1,58 @@
+{ config, lib, pkgs, ... }:
+
+{
+  options.chvp.services.headscale.enable = lib.mkOption {
+    default = false;
+    example = true;
+  };
+
+  config = lib.mkIf config.chvp.services.headscale.enable {
+    networking.firewall = {
+      allowedTCPPorts = [ 50443 ];
+      allowedUDPPorts = [ 3478 ];
+    };
+    services = {
+      headscale = {
+        enable = true;
+        serverUrl = "https://headscale.vanpetegem.me";
+        privateKeyFile = config.age.secrets."passwords/services/headscale".path;
+        database = {
+          type = "postgres";
+          name = "headscale";
+          user = "headscale";
+          host = "/run/postgresql";
+        };
+        dns = {
+          domains = [ "vanpetegem.internal" ];
+          baseDomain = "vanpetegem.me";
+        };
+      };
+      postgresql = {
+        enable = true;
+        dataDir = "${config.chvp.dataPrefix}/var/lib/postgresql/${config.services.postgresql.package.psqlSchema}";
+        ensureDatabases = [ "headscale" ];
+        ensureUsers = [{
+          name = "headscale";
+          ensurePermissions = { "DATABASE headscale" = "ALL PRIVILEGES"; };
+        }];
+      };
+    };
+    chvp.services.nginx.hosts = [
+      {
+        fqdn = "headscale.vanpetegem.me";
+        options.locations."/" = {
+          proxyPass = "http://localhost:8080";
+          extraConfig = ''
+            proxy_buffering off;
+            proxy_set_header X-Forwarded-Ssl on;
+          '';
+          proxyWebsockets = true;
+        };
+      }
+    ];
+    age.secrets."passwords/services/headscale" = {
+      file = ../../../secrets/passwords/services/headscale.age;
+      owner = "headscale";
+    };
+  };
+}

secrets.nix

@@ -53,6 +53,8 @@ in
 
   "secrets/passwords/services/acme.age".publicKeys = servers ++ users;
 
+  "secrets/passwords/services/headscale.age".publicKeys = [ lasting-integrity ] ++ users;
+
   "secrets/passwords/services/mastodon/otp.age".publicKeys = [ lasting-integrity ] ++ users;
   "secrets/passwords/services/mastodon/key.age".publicKeys = [ lasting-integrity ] ++ users;
   "secrets/passwords/services/mastodon/vapid-public.age".publicKeys = [ lasting-integrity ] ++ users;

secrets/passwords/services/headscale.age

@@ -0,0 +1,13 @@
+age-encryption.org/v1
+-> ssh-ed25519 hKAFvQ bUJdedi6WFknMHBO0yUwDMVNzDfZGpb5WQfWxoRR6ig
+HxaqBOyI9j+tcJzTMWjYVoKbsY68Sl2K+UfN0mikzT0
+-> ssh-ed25519 s9rb8g n2x0kV0upAR85Mykol111tU0V8xcfi0o2MAncV1GyQM
+yJDMGeliaiMpyFmmzF9zsIvua3EBc03TIvKT4LJzwN8
+-> ssh-ed25519 yad4VQ vlx896wSYkhYqOA2ZfJ2cmo0vlmPGl3WH8D52xyKdg0
++sThY/kHvJGZofKLuzOg6ABi5N/c5BEHv9F6exMw3XU
+-> w-grease eksf:Dr4
+aKmCHJS6K12oH85lBRqARdvUz3iEDn/eMjw2QZ4AGnLjdXAjhDgpBpuIak9iZr7u
+KKKtCTzqEkhO5BAG+xlNcXQtPEOZQCV+WvuMMPOdxLxUVNBUcAzjlKgW5quj7FQ
+--- rnya2T3ImTFIVMI5MxxhJ1DXLHJgSKwUMvcV5xkaZeU
+ñ¶ÖIzÓ6’ôÍÊÙýƒ°<Óg<C393>Ì®NœOJ)ï>û/°_Ä<5F>¢v{Ì,ò ´´}
µÅ’ñ•Öþ¢˜e~'Qµ°íþÒ‘0'¬ÍH'4ÝÞØ9Æa<C386>ƒ×v
+œ–M™›j¿