67 lines
1.7 KiB
Nix
67 lines
1.7 KiB
Nix
{ config
|
|
, lib
|
|
, pkgs
|
|
, ...
|
|
}:
|
|
with lib; {
|
|
options = {
|
|
zerotier = {
|
|
enable = mkOption {
|
|
description = "Enable ZeroTier";
|
|
default = false;
|
|
example = true;
|
|
type = lib.types.bool;
|
|
};
|
|
};
|
|
tailscale = {
|
|
enable = mkOption {
|
|
description = "Enable TailScale";
|
|
default = true;
|
|
example = true;
|
|
type = lib.types.bool;
|
|
};
|
|
sshOnly = mkOption {
|
|
description = "Enable TailScale with only ssh traffic to the tailnet allowed";
|
|
default = false;
|
|
example = true;
|
|
type = lib.types.bool;
|
|
};
|
|
};
|
|
};
|
|
|
|
config = mkMerge [
|
|
(mkIf config.tailscale.enable {
|
|
services = { tailscale = { enable = mkDefault true; }; };
|
|
networking.firewall.checkReversePath = mkDefault "loose";
|
|
})
|
|
(mkIf (config.tailscale.enable && config.tailscale.sshOnly) {
|
|
sops.secrets = {
|
|
ts_sshonly = {
|
|
sopsFile = config.xin-secrets.net-overlays;
|
|
owner = "root";
|
|
mode = "400";
|
|
};
|
|
};
|
|
systemd.services = {
|
|
"tailscale-ssh-init" = {
|
|
wantedBy = [ "tailscaled.service" ];
|
|
after = [ "tailscaled.service" ];
|
|
serviceConfig = {
|
|
ExecStart = "${pkgs.tailscale}/bin/tailscale up --auth-key file://${config.sops.secrets.ts_sshonly.path}";
|
|
};
|
|
};
|
|
};
|
|
})
|
|
(mkIf config.zerotier.enable {
|
|
environment.systemPackages = with pkgs; [ zerotierone ];
|
|
services = {
|
|
zerotierone = {
|
|
enable = true;
|
|
joinNetworks = [ "db64858fedd3b256" ];
|
|
};
|
|
};
|
|
networking.firewall.checkReversePath = "loose";
|
|
})
|
|
];
|
|
}
|