emelie/nix-deploy
1
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases Wiki Activity

Add tailscale

Browse source
This commit is contained in:
Emelie Graven 2022-10-24 11:13:11 +02:00
parent b738c1451f
commit 25fb72c8ec
No known key found for this signature in database
GPG key ID: 1098DC5C94CB1C87
9 changed files with 166 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

15
config/hosts/grondahl/configuration.nix
View file

@ -6,7 +6,8 @@
./hardware-configuration.nix
./data/secrets/secrets.nix
../../common/services/ssh.nix
../../common/users.nix
../../common/services/tailscale.nix
../../common/users.nix
./services/acme.nix
./services/coturn.nix
./services/nginx.nix
@ -72,9 +73,15 @@
dig
];
networking.firewall.allowedTCPPorts = [ 22 80 443 ];
networking.firewall.allowedTCPPortRanges = [ { from = 3478; to = 3479; } { from = 5349; to = 5350; } ];
networking.firewall.allowedUDPPortRanges = [ { from = 3478; to = 3479; } { from = 5349; to = 5350; } { from = 49152; to = 49999; } ];
networking.firewall = {
enable = true;
checkReversePath = "loose";
trustedInterfaces = [ "tailscale0" ];
allowedUDPPorts = [ config.services.tailscale.port ];
allowedTCPPorts = [ 22 80 443 ];
allowedTCPPortRanges = [ { from = 3478; to = 3479; } { from = 5349; to = 5350; } ];
allowedUDPPortRanges = [ { from = 3478; to = 3479; } { from = 5349; to = 5350; } { from = 49152; to = 49999; } ];
};
system.stateVersion = "21.05";

12
config/hosts/rudiger/configuration.nix
View file

@ -6,7 +6,8 @@
./hardware-configuration.nix
./data/secrets/secrets.nix
../../common/services/ssh.nix
../../common/users.nix
../../common/services/tailscale.nix
../../common/users.nix
./services/acme.nix
./services/nextcloud.nix
./services/nginx.nix
@ -65,6 +66,7 @@
htop
iotop
dig
tailscale
];
security.sudo.wheelNeedsPassword = false;
@ -76,7 +78,13 @@
users.groups.redis.members = [ "nextcloud" ];
users.groups.backup.members = [ "nextcloud" "postgres" ];
networking.firewall.allowedTCPPorts = [ 22 80 443 ];
networking.firewall = {
allowedTCPPorts = [ 22 80 443 ];
allowedUDPPorts = [ config.services.tailscale.port ];
trustedInterfaces = [ "tailscale0" ];
enable = true;
checkReversePath = "loose";
};
# networking.firewall.allowedUDPPorts = [ ... ];
system.stateVersion = "21.05";

2
config/hosts/wind/configuration.nix
View file

@ -4,6 +4,7 @@
imports = [
./hardware-configuration.nix
../../common/services/ssh.nix
../../common/services/tailscale.nix
../../common/users.nix
./services/acme.nix
./services/coturn.nix
@ -51,6 +52,7 @@
htop
iotop
dig
tailscale
];
nix.settings = {

9
config/hosts/wind/services/grocy.nix
View file

@ -2,9 +2,10 @@
{
services.grocy = {
enable = true;
hostName = grocy.graven.dev;
hostName = "grocy.graven.dev";
settings = {
currency = "DKK";
calendar.firstDayOfWeek = 1
}
}
calendar.firstDayOfWeek = 1;
};
};
}

1
config/hosts/wind/services/nginx.nix
View file

@ -14,7 +14,6 @@
add_header Access-Control-Allow-Origin "*";
add_header Strict-Transport-Security $hsts_header;
add_header Referrer-Policy "same-origin";
add_header X-Frame-Options "DENY";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "1; mode=block";
'';