ooks/ooknet
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(tailscale): disabled the auto-connect service

Browse source
This commit is contained in:
ooks-io 2024-06-17 16:40:34 +12:00
parent de551e8393
commit 0b7cd62705
3 changed files with 13 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

35
nixos/modules/base/networking/tailscale.nix
View file

@ -8,47 +8,30 @@ in
{ {
config = mkIf cfg.enable { config = mkIf cfg.enable {
services.tailscale = { services.tailscale = {
enable = true; enable = true;
useRoutingFeatures = mkDefault "both"; useRoutingFeatures = mkDefault "both";
# permitCertUid = "root"; permitCertUid = "root";
extraUpFlags = cfg.flags.final; extraUpFlags = cfg.flags.final;
authKeyFile = "${config.age.secrets.tailscale-auth.path}";
}; };
networking.firewall = { networking.firewall = {
allowedUDPPorts = [tailscale.port]; allowedUDPPorts = [tailscale.port];
trustedInterfaces = ["${tailscale.interfaceName}"]; trustedInterfaces = ["${tailscale.interfaceName}"];
checkReversePath = "loose"; checkReversePath = "loose";
}; };
users = {
groups.tailscaled = {};
users.tailscaled = {
group = "tailscaled";
isSystemUser = true;
};
};
systemd.network.wait-online.ignoredInterfaces = ["${tailscale.interfaceName}"]; systemd.network.wait-online.ignoredInterfaces = ["${tailscale.interfaceName}"];
environment.systemPackages = [ pkgs.tailscale ]; environment.systemPackages = [ pkgs.tailscale ];
# disable tailscale logging # disable tailscale logging
systemd.services.tailscaled.serviceConfig.Environment = mkBefore ["TS_NO_LOGS_NO_SUPPORT"]; systemd.services.tailscaled.serviceConfig.Environment = mkBefore ["TS_NO_LOGS_NO_SUPPORT"];
systemd.services.tailscale-autoconnect = mkIf cfg.autoconnect {
description = "Automatic connection to Tailscale";
after = [ "network-pre.target" "tailscale.service" ];
wants = [ "network-pre.target" "tailscale.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot";
script = /* bash */ ''
sleep 2
status="$(${tailscale.package}/bin/tailscale status -json | ${pkgs.jq}/bin/jq -r .BackendState)"
if [ $status = "Running" ]; then
exit 0
fi
${tailscale.package}/bin/tailscale up ${toString tailscale.extraUpFlags}
'';
};
}; };
} }

4
nixos/modules/host/admin.nix
View file

@ -1,4 +1,4 @@
{ lib, config, pkgs, inputs, outputs, self, ... }: { lib, config, pkgs, inputs, outputs, self, keys, ... }:
let let
cfg = config.ooknet.host.admin; cfg = config.ooknet.host.admin;
@ -12,7 +12,7 @@ in
isNormalUser = true; isNormalUser = true;
shell = pkgs.${cfg.shell}; shell = pkgs.${cfg.shell};
initialPassword = "password"; initialPassword = "password";
openssh.authorizedKeys.keys = [ "${cfg.sshKey}" ]; openssh.authorizedKeys.keys = [ (keys.users."${cfg.name}") ];
extraGroups = [ extraGroups = [
"wheel" "wheel"
"video" "video"

5
nixos/options/host.nix
View file

@ -75,8 +75,7 @@ in
tags = mkOption { tags = mkOption {
type = listOf str; type = listOf str;
default = default =
if tailscale.client then ["tag:client"] if tailscale.server then ["tag:server"]
else if tailscale.server then ["tag:server"]
else []; else [];
description = "Sets host tag depending on if server/client"; description = "Sets host tag depending on if server/client";
}; };
@ -98,7 +97,7 @@ in
tailscale.flags.default tailscale.flags.default
(optionals (tailscale.authkey != null) ["--authkey file:${config.age.secrets.tailscale-auth.path}"]) (optionals (tailscale.authkey != null) ["--authkey file:${config.age.secrets.tailscale-auth.path}"])
(optionals (tailscale.operator != null) ["--operator ${tailscale.operator}"]) (optionals (tailscale.operator != null) ["--operator ${tailscale.operator}"])
(optionals (tailscale.tags != []) ["--advertise-tags" (concatStringsSep "," tailscale.tags)]) # (optionals (tailscale.tags != []) ["--advertise-tags" (concatStringsSep "," tailscale.tags)])
(optionals tailscale.server ["--advertise-exit-node"]) (optionals tailscale.server ["--advertise-exit-node"])
]; ];
}; };