emelie/nix-deploy
1
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases Wiki Activity

Add tailscale

Browse source
This commit is contained in:
Emelie Graven 2022-10-24 11:13:11 +02:00
parent b738c1451f
commit 25fb72c8ec
No known key found for this signature in database
GPG key ID: 1098DC5C94CB1C87
9 changed files with 166 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

88
] Normal file
View file

@ -0,0 +1,88 @@
{ config, pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
./data/secrets/secrets.nix
../../common/services/ssh.nix
../../common/services/tailscale.nix
../../common/users.nix
./services/acme.nix
./services/coturn.nix
./services/nginx.nix
./services/restic.nix
./services/synapse.nix
./services/postgres.nix
#./services/mail.nix
#./services/containers.nix
#./services/redis.nix
];
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/vda";
boot.kernelPackages = pkgs.linuxPackages_5_10;
networking = {
hostName = "grondahl";
useDHCP = false;
interfaces = {
"ens3" = {
ipv4.addresses = [ {
address = "107.189.30.157";
prefixLength = 24;
} ];
ipv6.addresses = [ {
address = "2605:6400:30:ef32::1";
prefixLength = 48;
} ];
};
};
defaultGateway = "107.189.30.1";
defaultGateway6 = {
address = "2605:6400:30::1";
interface = "ens3";
};
nameservers = [ "1.1.1.1" "1.0.0.1" "2606:4700:4700::1111" "2606:4700:4700::1001" ];
};
time.timeZone = "Europe/Copenhagen";
security.sudo.wheelNeedsPassword = false;
nix.settings = {
auto-optimise-store = true;
trusted-users = [
"root"
"@wheel"
];
};
users.groups.acme.members = [ "nginx" "turnserver" ];
users.groups.backup.members = [ "matrix-synapse" "postgres" ];
# List packages installed in system profile. To search, run:
# $ nix search wget
environment.systemPackages = with pkgs; [
vim
wget
htop
iotop
dig
];
networking.firewall = {
enable = true;
checkReversePaths = "loose";
trustedInterfaces = [ "tailscale0" ];
allowedUDPPorts = [ config.services.tailscale.port ];
allowedTCPPorts = [ 22 80 443 ];
allowedTCPPortRanges = [ { from = 3478; to = 3479; } { from = 5349; to = 5350; } ];
allowedUDPPortRanges = [ { from = 3478; to = 3479; } { from = 5349; to = 5350; } { from = 49152; to = 49999; } ];
};
system.stateVersion = "21.05";
}

2
config/common/services/nginx.nix
View file

@ -29,7 +29,7 @@
add_header 'Referrer-Policy' 'same-origin';
# Disable embedding as a frame
add_header X-Frame-Options DENY;
#add_header X-Frame-Options DENY;
# Prevent injection of code in other mime types (XSS Attacks)
add_header X-Content-Type-Options nosniff;

37
config/common/services/tailscale.nix Normal file
View file

@ -0,0 +1,37 @@
{ config, pkgs, ... }:
{
environment.systemPackages = [ pkgs.tailscale ];
services.tailscale.enable = true;
# ...
# create a oneshot job to authenticate to Tailscale
systemd.services.tailscale-autoconnect = {
description = "Automatic connection to Tailscale";
# make sure tailscale is running before trying to connect to tailscale
after = [ "network-pre.target" "tailscale.service" ];
wants = [ "network-pre.target" "tailscale.service" ];
wantedBy = [ "multi-user.target" ];
# set this service as a oneshot job
serviceConfig.Type = "oneshot";
# have the job run this shell script
script = with pkgs; ''
# wait for tailscaled to settle
sleep 2
# check if we are already authenticated to tailscale
status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
if [ $status = "Running" ]; then # if so, then do nothing
exit 0
fi
# otherwise authenticate with tailscale
${tailscale}/bin/tailscale up -authkey CHANGEME
'';
};
}

15
config/hosts/grondahl/configuration.nix
View file

@ -6,7 +6,8 @@
./hardware-configuration.nix
./data/secrets/secrets.nix
../../common/services/ssh.nix
../../common/users.nix
../../common/services/tailscale.nix
../../common/users.nix
./services/acme.nix
./services/coturn.nix
./services/nginx.nix
@ -72,9 +73,15 @@
dig
];
networking.firewall.allowedTCPPorts = [ 22 80 443 ];
networking.firewall.allowedTCPPortRanges = [ { from = 3478; to = 3479; } { from = 5349; to = 5350; } ];
networking.firewall.allowedUDPPortRanges = [ { from = 3478; to = 3479; } { from = 5349; to = 5350; } { from = 49152; to = 49999; } ];
networking.firewall = {
enable = true;
checkReversePath = "loose";
trustedInterfaces = [ "tailscale0" ];
allowedUDPPorts = [ config.services.tailscale.port ];
allowedTCPPorts = [ 22 80 443 ];
allowedTCPPortRanges = [ { from = 3478; to = 3479; } { from = 5349; to = 5350; } ];
allowedUDPPortRanges = [ { from = 3478; to = 3479; } { from = 5349; to = 5350; } { from = 49152; to = 49999; } ];
};
system.stateVersion = "21.05";

12
config/hosts/rudiger/configuration.nix
View file

@ -6,7 +6,8 @@
./hardware-configuration.nix
./data/secrets/secrets.nix
../../common/services/ssh.nix
../../common/users.nix
../../common/services/tailscale.nix
../../common/users.nix
./services/acme.nix
./services/nextcloud.nix
./services/nginx.nix
@ -65,6 +66,7 @@
htop
iotop
dig
tailscale
];
security.sudo.wheelNeedsPassword = false;
@ -76,7 +78,13 @@
users.groups.redis.members = [ "nextcloud" ];
users.groups.backup.members = [ "nextcloud" "postgres" ];
networking.firewall.allowedTCPPorts = [ 22 80 443 ];
networking.firewall = {
allowedTCPPorts = [ 22 80 443 ];
allowedUDPPorts = [ config.services.tailscale.port ];
trustedInterfaces = [ "tailscale0" ];
enable = true;
checkReversePath = "loose";
};
# networking.firewall.allowedUDPPorts = [ ... ];
system.stateVersion = "21.05";

2
config/hosts/wind/configuration.nix
View file

@ -4,6 +4,7 @@
imports = [
./hardware-configuration.nix
../../common/services/ssh.nix
../../common/services/tailscale.nix
../../common/users.nix
./services/acme.nix
./services/coturn.nix
@ -51,6 +52,7 @@
htop
iotop
dig
tailscale
];
nix.settings = {

9
config/hosts/wind/services/grocy.nix
View file

@ -2,9 +2,10 @@
{
services.grocy = {
enable = true;
hostName = grocy.graven.dev;
hostName = "grocy.graven.dev";
settings = {
currency = "DKK";
calendar.firstDayOfWeek = 1
}
}
calendar.firstDayOfWeek = 1;
};
};
}

1
config/hosts/wind/services/nginx.nix
View file

@ -14,7 +14,6 @@
add_header Access-Control-Allow-Origin "*";
add_header Strict-Transport-Security $hsts_header;
add_header Referrer-Policy "same-origin";
add_header X-Frame-Options "DENY";
add_header X-Content-Type-Options "nosniff";
add_header X-XSS-Protection "1; mode=block";
'';

24
config/sources/nix/sources.json
View file

@ -5,10 +5,10 @@
"homepage": "https://github.com/nmattia/niv",
"owner": "nmattia",
"repo": "niv",
"rev": "82e5cd1ad3c387863f0545d7591512e76ab0fc41",
"sha256": "090l219mzc0gi33i3psgph6s2pwsc8qy4lyrqjdj4qzkvmaj65a7",
"rev": "351d8bc316bf901a81885bab5f52687ec8ccab6e",
"sha256": "1yzhz7ihkh6p2sxhp3amqfbmm2yqzaadqqii1xijymvl8alw5rrr",
"type": "tarball",
"url": "https://github.com/nmattia/niv/archive/82e5cd1ad3c387863f0545d7591512e76ab0fc41.tar.gz",
"url": "https://github.com/nmattia/niv/archive/351d8bc316bf901a81885bab5f52687ec8ccab6e.tar.gz",
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
},
"nixos-hardware": {
@ -17,10 +17,10 @@
"homepage": "",
"owner": "NixOS",
"repo": "nixos-hardware",
"rev": "1fec8fda86dac5701146c77d5f8a414b14ed1ff6",
"sha256": "18z2v5id3sad22f4nk8yjpablk9c693nwl5vix2n06h6s3kfmr10",
"rev": "0e6593630071440eb89cd97a52921497482b22c6",
"sha256": "01rnzb4qv53q7rf0vw2mxybryl5xgad26ww73fgsg2nihhhmmy9j",
"type": "tarball",
"url": "https://github.com/NixOS/nixos-hardware/archive/1fec8fda86dac5701146c77d5f8a414b14ed1ff6.tar.gz",
"url": "https://github.com/NixOS/nixos-hardware/archive/0e6593630071440eb89cd97a52921497482b22c6.tar.gz",
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
},
"nixpkgs": {
@ -29,10 +29,10 @@
"homepage": "",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "ccafeb2aff99ec505d35fcfafd212c424c5359fd",
"sha256": "0q9kxp7n7394f8s7nqm8852gmwka0xn973q2vf3qh5qrwkv441qj",
"rev": "6b8ce46f34a9b3db1267f615463cd27548889ec2",
"sha256": "1minhg4q7vgbf69lf85blmamjxl1r7c1j26n7f80as9b0dn4aj7a",
"type": "tarball",
"url": "https://github.com/NixOS/nixpkgs/archive/ccafeb2aff99ec505d35fcfafd212c424c5359fd.tar.gz",
"url": "https://github.com/NixOS/nixpkgs/archive/6b8ce46f34a9b3db1267f615463cd27548889ec2.tar.gz",
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
},
"nixus": {
@ -41,10 +41,10 @@
"homepage": "",
"owner": "Infinisil",
"repo": "nixus",
"rev": "aa276744ba7dcebeac40da37d7bf4d9d5409f17e",
"sha256": "1wfx055h1765zq7s1zzy06im8f715ydvp8qbhfcn6bpg44qr591b",
"rev": "329bf6bae94f54d5e4cac35253b1359f7b4f997a",
"sha256": "0g6k2r446a8vcqzab76qzvfw5k1kzk6i8m4032jmkdr1w5rhlg4b",
"type": "tarball",
"url": "https://github.com/Infinisil/nixus/archive/aa276744ba7dcebeac40da37d7bf4d9d5409f17e.tar.gz",
"url": "https://github.com/Infinisil/nixus/archive/329bf6bae94f54d5e4cac35253b1359f7b4f997a.tar.gz",
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
}
}