85 lines
2.1 KiB
Nix
85 lines
2.1 KiB
Nix
{
|
|
config,
|
|
headscale,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
inherit (builtins) readFile;
|
|
inherit (lib) mkAfter mkForce;
|
|
inherit (pkgs.writers) writeYAML;
|
|
|
|
inherit (config.vars) mainUser hostName;
|
|
headscale-flake = headscale.packages.${pkgs.system}.headscale;
|
|
|
|
clusterIP = config.services.pcsd.virtualIps.caddy-vip.ip;
|
|
in {
|
|
environment.systemPackages = [headscale-flake];
|
|
users.users.${mainUser}.extraGroups = ["headscale"];
|
|
|
|
home-manager.users.${mainUser}
|
|
.programs.bash.bashrcExtra = mkAfter (readFile ./completion.bash);
|
|
|
|
services.headscale = {
|
|
enable = true;
|
|
package = headscale-flake;
|
|
};
|
|
|
|
environment.etc."headscale/config.yaml".source = mkForce (
|
|
writeYAML "headscale.yaml" {
|
|
server_url = "https://headscale.nelim.org";
|
|
listen_addr = "${clusterIP}:8085";
|
|
prefixes = {
|
|
v4 = "100.64.0.0/10";
|
|
v6 = "fd7a:115c:a1e0::/48";
|
|
};
|
|
metrics_listen_addr = "127.0.0.1:9090";
|
|
grpc_listen_addr = "0.0.0.0:50443";
|
|
grpc_allow_insecure = false;
|
|
disable_check_updates = true;
|
|
ephemeral_node_inactivity_timeout = "30m";
|
|
unix_socket = "/run/headscale/headscale.sock";
|
|
unix_socket_permission = "0770";
|
|
|
|
database = {
|
|
type = "sqlite";
|
|
sqlite.path = "/var/lib/headscale/db.sqlite";
|
|
};
|
|
|
|
private_key_path = "/var/lib/headscale/private.key";
|
|
noise.private_key_path = "/var/lib/headscale/noise_private.key";
|
|
|
|
dns_config = let
|
|
caddyIp =
|
|
if hostName == "thingone"
|
|
then "100.64.0.8"
|
|
else "100.64.0.9";
|
|
in {
|
|
magic_dns = false;
|
|
override_local_dns = true;
|
|
nameservers = [caddyIp];
|
|
};
|
|
|
|
log = {
|
|
format = "text";
|
|
level = "info";
|
|
};
|
|
|
|
derp = {
|
|
auto_update_enable = true;
|
|
update_frequency = "24h";
|
|
|
|
server = {
|
|
enabled = true;
|
|
stun_listen_addr = "${clusterIP}:3479";
|
|
private_key_path = "/var/lib/headscale/derp_server_private.key";
|
|
|
|
region_id = 995;
|
|
region_code = "mon";
|
|
region_name = "montreal";
|
|
};
|
|
};
|
|
}
|
|
);
|
|
}
|