services: tailscale: refacto

This commit is contained in:
Antoine Martin 2023-12-13 17:43:53 +01:00
parent 2a49eea1bf
commit 89c861c974
5 changed files with 23 additions and 17 deletions

View file

@ -75,7 +75,10 @@
pipewire.enable = true;
tailscale.enable = true;
tailscale = {
enable = true;
useRoutingFeatures = "both";
};
};
services = {

View file

@ -133,7 +133,7 @@ in {
tailscale = {
enable = true;
exitNode = true;
useRoutingFeatures = "server";
};
transmission = {

View file

@ -49,7 +49,11 @@
# List services that you want to enable:
my.services = {
tailscale.enable = true;
tailscale = {
enable = true;
useRoutingFeatures = "client";
};
pipewire.enable = true;
restic-backup = {

View file

@ -28,7 +28,10 @@ in {
# List services that you want to enable:
my.services = {
tailscale.enable = true;
tailscale = {
enable = true;
useRoutingFeatures = "both";
};
};
services = {

View file

@ -8,34 +8,30 @@
(lib)
mkEnableOption
mkIf
mkOption
types
;
cfg = config.my.services.tailscale;
in {
options.my.services.tailscale = {
enable = mkEnableOption "Tailscale";
# NOTE: still have to do `tailscale up --advertise-exit-node`
exitNode = mkEnableOption "Use as exit node";
useRoutingFeatures = mkOption {
type = types.enum ["none" "client" "server" "both"];
default = "none";
};
};
config = mkIf cfg.enable {
services.tailscale = {
enable = true;
package = pkgs.tailscale;
openFirewall = true;
useRoutingFeatures = cfg.useRoutingFeatures;
};
networking.firewall = {
trustedInterfaces = ["tailscale0"];
allowedUDPPorts = [config.services.tailscale.port];
# needed for exit node usage
checkReversePath = mkIf (!cfg.exitNode) "loose";
};
# enable IP forwarding to use as exit node
boot.kernel.sysctl = mkIf cfg.exitNode {
"net.ipv6.conf.all.forwarding" = true;
"net.ipv4.ip_forward" = true;
trustedInterfaces = [config.services.tailscale.interfaceName];
};
};
}