feat(nixos:tailscale): add auto-connect service

nixos/modules/base/default.nix

@@ -7,5 +7,6 @@
     ./security
     ./shell
     ./locale.nix
+    ./secrets.nix
   ];
 }

nixos/modules/base/networking/tailscale.nix

@@ -3,9 +3,7 @@
 let
   cfg = config.ooknet.host.networking.tailscale;
   inherit (config.services) tailscale;
-  inherit (lib.lists) optionals;
-  inherit (lib.strings) concatStringsSep;
-  inherit (lib) mkIf mkDefault;
+  inherit (lib) mkIf mkDefault mkBefore;
 in
 
 {
@@ -15,10 +13,7 @@ in
       enable = true;
       useRoutingFeatures = mkDefault "both";
       # permitCertUid = "root";
-      extraUpFlags = 
-        [ "--ssh" "--operator=$USER" ]
-        ++ optionals cfg.server [ "--advertise-exit-node" ]
-        ++ optionals (cfg.tags != []) ["--advertise-tags" (concatStringsSep "," cfg.tags)]; 
+      extraUpFlags = cfg.flags.final;
     };
 
     networking.firewall = {
@@ -30,5 +25,30 @@ in
     systemd.network.wait-online.ignoredInterfaces = ["${tailscale.interfaceName}"];
 
     environment.systemPackages = [ pkgs.tailscale ];
+
+    # disable tailscale logging
+    systemd.services.tailscaled.serviceConfig.Environment = mkBefore ["TS_NO_LOGS_NO_SUPPORT"];
+
+    systemd.services.tailscale-autoconnect = mkIf cfg.autoconnect {
+      description = "Automatic connection to Tailscale";
+
+      after = [ "network-pre.target" "tailscale.service" ];
+      wants = [ "network-pre.target" "tailscale.service" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig.Type = "oneshot";
+
+      script = /* bash */ ''
+        sleep 2
+
+        status="$(${tailscale.package}/bin/tailscale status -json | ${pkgs.jq}/bin/jq -r .BackendState)"
+
+        if [ $status = "Running" ]; then
+          exit 0
+        fi
+
+        ${tailscale.package}/bin/tailscale up ${toString tailscale.extraUpFlags}
+      '';
+    };
   };
 }

nixos/options/host.nix

@@ -3,6 +3,9 @@
 let
   inherit (lib) mkOption mkEnableOption;
   inherit (lib.types) bool enum listOf int submodule nullOr str;
+  inherit (lib.lists) optionals concatLists;
+  inherit (builtins) concatStringsSep;
+
   admin = config.ooknet.host.admin;
   hardware = config.ooknet.host.hardware;
   tailscale = config.ooknet.host.networking.tailscale;
@@ -54,9 +57,15 @@ in
       homeManager = mkEnableOption "";
     };
 
+    # tailscale options brought to you by github:notashelf/nyx
     networking = {
       tailscale = {
         enable = mkEnableOption "Enable tailscale system module";
+        autoconnect = mkEnableOption "Enable auto connect tailscale service";
+        authkey = mkOption {
+          type = str;
+          default = config.age.secrets.tailscale-auth.path;
+        };
         server = mkOption {
           type = bool;
           default = false;
@@ -67,7 +76,7 @@ in
           default = tailscale.enable;
           description = "Define if the host is a client";
         };
-        tag = mkOption {
+        tags = mkOption {
           type = listOf str;
           default = 
             if tailscale.client then ["tag:client"]
@@ -80,6 +89,24 @@ in
           default = "${admin.name}";
           description = "Name of the tailscale operator";
         };
+        flags = {
+          default = mkOption {
+            type = listOf str;
+            default = ["--ssh"];
+          };
+          final = mkOption {
+            type = listOf str;
+            internal = true;
+            readOnly = true;
+            default = concatLists [
+              tailscale.flags.default
+              (optionals (tailscale.authkey != null) ["--authkey file:${config.age.secrets.tailscale-auth.path}"])
+              (optionals (tailscale.operator != null) ["--operator ${tailscale.operator}"])
+              (optionals (tailscale.tags != []) ["--advertise-tags" (concatStringsSep "," tailscale.tags)])
+              (optionals tailscale.server ["--advertise-exit-node"])
+            ];
+          };
+        };
       };
     };
 
@@ -185,7 +212,7 @@ in
     assertions = [{
       assertion = ((lib.length hardware.monitors) != 0) ->
         ((lib.length (lib.filter (m: m.primary) hardware.monitors)) == 1);
-      message = "Exactly one monitor must be set to primary.";
+      message = "At least 1 primary monitor is required";
     }];
   };
 }