xin/configs/net-overlay.nix

68 lines
1.8 KiB
Nix

{ config
, lib
, pkgs
, ...
}:
with lib; {
options = {
zerotier = {
enable = mkOption {
description = "Enable ZeroTier";
default = false;
example = true;
type = lib.types.bool;
};
};
tailscale = {
enable = mkOption {
description = "Enable TailScale";
default = true;
example = true;
type = lib.types.bool;
};
sshOnly = mkOption {
description = "Enable TailScale with only ssh traffic to the tailnet allowed";
default = false;
example = true;
type = lib.types.bool;
};
};
};
config = mkMerge [
(mkIf config.tailscale.enable {
services = { tailscale = { enable = mkDefault true; }; };
systemd.services.tailscaled.serviceConfig.Environment = [ "TS_NO_LOGS_NO_SUPPORT=true" ];
networking.firewall.checkReversePath = mkDefault "loose";
})
(mkIf (config.tailscale.enable && config.tailscale.sshOnly) {
sops.secrets = {
ts_sshonly = {
sopsFile = config.xin-secrets.net-overlays;
owner = "root";
mode = "400";
};
};
systemd.services = {
"tailscale-ssh-init" = {
wantedBy = [ "tailscaled.service" ];
after = [ "tailscaled.service" ];
serviceConfig = {
ExecStart = "${pkgs.tailscale}/bin/tailscale up --auth-key file://${config.sops.secrets.ts_sshonly.path}";
};
};
};
})
(mkIf config.zerotier.enable {
environment.systemPackages = with pkgs; [ zerotierone ];
services = {
zerotierone = {
enable = true;
joinNetworks = [ "db64858fedd3b256" ];
};
};
networking.firewall.checkReversePath = "loose";
})
];
}