feat(nixos:tailscale): add auto-connect service

hosts/ooksdesk/default.nix

@@ -20,6 +20,7 @@
 			tailscale = {
 				enable = true;
 				client = true;
+				autoconnect = true;
 			};
 		};
 		hardware = {

hosts/ooksmedia/default.nix

@@ -25,6 +25,7 @@ in
 			tailscale = {
 				enable = true;
 				server = true;
+				autoconnect = true;
 			};
 		};
 		hardware = {

hosts/ooksmicro/default.nix

@@ -26,6 +26,7 @@ in
 			tailscale = {
 				enable = true;
 				client = true;
+				autoconnect = true;
 			};
 		};
 		hardware = {

hosts/ookst480s/default.nix

@@ -26,6 +26,7 @@ in
 			tailscale = {
 				enable = true;
 				client = true;
+				autoconnect = true;
 			};
 		};
 		hardware = {

nixos/modules/base/default.nix

@@ -7,5 +7,6 @@
     ./security
     ./shell
     ./locale.nix
+    ./secrets.nix
   ];
 }

nixos/modules/base/networking/tailscale.nix

@@ -3,9 +3,7 @@
 let
   cfg = config.ooknet.host.networking.tailscale;
   inherit (config.services) tailscale;
-  inherit (lib.lists) optionals;
+  inherit (lib) mkIf mkDefault mkBefore;
-  inherit (lib.strings) concatStringsSep;
-  inherit (lib) mkIf mkDefault;
 in
 
 {
@@ -15,10 +13,7 @@ in
       enable = true;
       useRoutingFeatures = mkDefault "both";
       # permitCertUid = "root";
-      extraUpFlags = 
+      extraUpFlags = cfg.flags.final;
-        [ "--ssh" "--operator=$USER" ]
-        ++ optionals cfg.server [ "--advertise-exit-node" ]
-        ++ optionals (cfg.tags != []) ["--advertise-tags" (concatStringsSep "," cfg.tags)]; 
     };
 
     networking.firewall = {
@@ -30,5 +25,30 @@ in
     systemd.network.wait-online.ignoredInterfaces = ["${tailscale.interfaceName}"];
 
     environment.systemPackages = [ pkgs.tailscale ];
+
+    # disable tailscale logging
+    systemd.services.tailscaled.serviceConfig.Environment = mkBefore ["TS_NO_LOGS_NO_SUPPORT"];
+
+    systemd.services.tailscale-autoconnect = mkIf cfg.autoconnect {
+      description = "Automatic connection to Tailscale";
+
+      after = [ "network-pre.target" "tailscale.service" ];
+      wants = [ "network-pre.target" "tailscale.service" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig.Type = "oneshot";
+
+      script = /* bash */ ''
+        sleep 2
+
+        status="$(${tailscale.package}/bin/tailscale status -json | ${pkgs.jq}/bin/jq -r .BackendState)"
+
+        if [ $status = "Running" ]; then
+          exit 0
+        fi
+
+        ${tailscale.package}/bin/tailscale up ${toString tailscale.extraUpFlags}
+      '';
+    };
   };
 }

nixos/options/host.nix

@@ -3,6 +3,9 @@
 let
   inherit (lib) mkOption mkEnableOption;
   inherit (lib.types) bool enum listOf int submodule nullOr str;
+  inherit (lib.lists) optionals concatLists;
+  inherit (builtins) concatStringsSep;
+
   admin = config.ooknet.host.admin;
   hardware = config.ooknet.host.hardware;
   tailscale = config.ooknet.host.networking.tailscale;
@@ -54,9 +57,15 @@ in
       homeManager = mkEnableOption "";
     };
 
+    # tailscale options brought to you by github:notashelf/nyx
     networking = {
       tailscale = {
         enable = mkEnableOption "Enable tailscale system module";
+        autoconnect = mkEnableOption "Enable auto connect tailscale service";
+        authkey = mkOption {
+          type = str;
+          default = config.age.secrets.tailscale-auth.path;
+        };
         server = mkOption {
           type = bool;
           default = false;
@@ -67,7 +76,7 @@ in
           default = tailscale.enable;
           description = "Define if the host is a client";
         };
-        tag = mkOption {
+        tags = mkOption {
           type = listOf str;
           default = 
             if tailscale.client then ["tag:client"]
@@ -80,6 +89,24 @@ in
           default = "${admin.name}";
           description = "Name of the tailscale operator";
         };
+        flags = {
+          default = mkOption {
+            type = listOf str;
+            default = ["--ssh"];
+          };
+          final = mkOption {
+            type = listOf str;
+            internal = true;
+            readOnly = true;
+            default = concatLists [
+              tailscale.flags.default
+              (optionals (tailscale.authkey != null) ["--authkey file:${config.age.secrets.tailscale-auth.path}"])
+              (optionals (tailscale.operator != null) ["--operator ${tailscale.operator}"])
+              (optionals (tailscale.tags != []) ["--advertise-tags" (concatStringsSep "," tailscale.tags)])
+              (optionals tailscale.server ["--advertise-exit-node"])
+            ];
+          };
+        };
       };
     };
 
@@ -185,7 +212,7 @@ in
     assertions = [{
       assertion = ((lib.length hardware.monitors) != 0) ->
         ((lib.length (lib.filter (m: m.primary) hardware.monitors)) == 1);
-      message = "Exactly one monitor must be set to primary.";
+      message = "At least 1 primary monitor is required";
     }];
   };
 }

outputs/nixos.nix

@@ -4,12 +4,19 @@ let
   inherit (inputs.nixpkgs.lib) nixosSystem;
   inherit (self) keys;
 
+  hosts = "${self}/hosts";
+
   hm = inputs.home-manager.nixosModules.home-manager;
   nixarr = inputs.nixarr.nixosModules.default;
   agenix = inputs.agenix.nixosModules.default;
 
   nixosModules = "${self}/nixos";
-  hosts = "${self}/hosts";
+
+  workstation = [
+    hm
+    agenix
+    nixosModules
+  ];
 
   specialArgs = {inherit withSystem keys inputs self;};
 in
@@ -18,49 +25,30 @@ in
   ooksdesk = nixosSystem {
     inherit specialArgs;
     system = "x86_64-linux";
-    modules = [
+    modules = [ "${hosts}/ooksdesk" ] ++ workstation;
-      "${hosts}/ooksdesk"
-      hm
-      agenix
-
-      nixosModules
-    ];
   };
+
   ookst480s = nixosSystem {
     inherit specialArgs;
     system = "x86_64-linux";
-    modules = [
+    modules = [ "${hosts}/ookst480s" ] ++ workstation;
-      "${hosts}/ookst480s"
-      hm
-      nixosModules
-    ];
   };
+
   ooksmedia = nixosSystem {
     inherit specialArgs;
     system = "x86_64-linux";
-    modules = [
+    modules = [ "${hosts}/ooksmedia" nixarr ] ++ workstation;
-      "${hosts}/ooksmedia"
-      hm
-      nixosModules
-      nixarr
-    ];
   };
+
   ooksmicro = nixosSystem {
     inherit specialArgs;
     system = "x86_64-linux";
-    modules = [
+    modules = [ "${hosts}/ooksmicro" ] ++ workstation;
-      "${hosts}/ooksmicro"
-      hm
-      nixosModules
-    ];
   };
+
   ooksx1 = nixosSystem {
     inherit specialArgs;
     system = "x86_64-linux";
-    modules = [
+    modules = [ "${hosts}/ooksx1" ] ++ workstation;
-      "${hosts}/ooksx1"
-      hm
-      nixosModules
-    ];
   };
 }