xin/configs/net-overlay.nix

65 lines
1.7 KiB
Nix

{ config, lib, pkgs, ... }:
with lib; {
options = {
zerotier = {
enable = mkOption {
description = "Enable ZeroTier";
default = false;
example = true;
type = lib.types.bool;
};
};
tailscale = {
enable = mkOption {
description = "Enable TailScale";
default = true;
example = true;
type = lib.types.bool;
};
sshOnly = mkOption {
description =
"Enable TailScale with only ssh traffic to the tailnet allowed";
default = false;
example = true;
type = lib.types.bool;
};
};
};
config = mkMerge [
(mkIf config.tailscale.enable {
services = { tailscale = { enable = mkDefault true; }; };
networking.firewall.checkReversePath = mkDefault "loose";
})
(mkIf (config.tailscale.enable && config.tailscale.sshOnly) {
sops.secrets = {
ts_sshonly = {
sopsFile = config.xin-secrets.net-overlays;
owner = "root";
mode = "400";
};
};
systemd.services = {
"tailscale-ssh-init" = {
wantedBy = [ "tailscaled.service" ];
after = [ "tailscaled.service" ];
serviceConfig = {
ExecStart =
"${pkgs.tailscale}/bin/tailscale up --auth-key file://${config.sops.secrets.ts_sshonly.path}";
};
};
};
})
(mkIf config.zerotier.enable {
environment.systemPackages = with pkgs; [ zerotierone ];
services = {
zerotierone = {
enable = true;
joinNetworks = [ "db64858fedd3b256" ];
};
};
networking.firewall.checkReversePath = "loose";
})
];
}