nix-home/nki-personal-do/headscale.nix

91 lines
2.6 KiB
Nix
Raw Permalink Normal View History

2023-05-04 16:30:55 +00:00
{ pkgs, config, lib, ... }:
let
secrets = config.sops.secrets;
host = "hs.dtth.ch";
port = 19876;
webuiPort = 19877;
in
rec {
sops.secrets."headscale/client_secret" = { owner = "headscale"; };
sops.secrets."headscale/webui-env" = { };
sops.secrets."headscale/derp-servers/vnm" = { owner = "headscale"; name = "headscale/derp-servers/vnm.yaml"; };
2023-05-04 16:30:55 +00:00
# database
cloud.postgresql.databases = [ "headscale" ];
# traefik
cloud.traefik.hosts.headscale = {
inherit port host;
filter = "Host(`hs.dtth.ch`) && !PathPrefix(`/admin`)";
2023-08-31 08:40:42 +00:00
noCloudflare = true;
2023-05-04 16:30:55 +00:00
};
2023-08-30 18:20:49 +00:00
# cloud.traefik.config.http.middlewares.hs-sslheader.headers.customrequestheaders.X-Forwarded-Proto = "https";
# cloud.traefik.config.http.routers.headscale-router.middlewares = [ "hs-sslheader" ];
2023-05-04 16:30:55 +00:00
cloud.traefik.hosts.headscale_webui = {
inherit host;
port = webuiPort;
filter = "Host(`hs.dtth.ch`) && PathPrefix(`/admin`)";
2023-08-31 08:40:42 +00:00
noCloudflare = true;
2023-05-04 16:30:55 +00:00
};
systemd.services.headscale.requires = [ "postgresql.service" ];
2023-05-04 16:30:55 +00:00
services.headscale = {
enable = true;
inherit port;
settings = {
server_url = "https://hs.dtth.ch";
db_type = "postgres";
db_host = "/var/run/postgresql"; # find out yourself
db_user = "headscale";
db_name = "headscale";
dns_config = {
base_domain = host;
};
noise = {
private_key_path = "/var/lib/headscale/noise_private.key";
};
ip_prefixes = [
"fd7a:115c:a1e0::/48"
"100.64.0.0/10"
];
derp.paths = [
secrets."headscale/derp-servers/vnm".path
];
2023-05-04 16:30:55 +00:00
oidc = {
only_start_if_oidc_is_available = true;
client_id = "XgHLi5CC7mbW6xF8wuOHq3xxCPagSUaHt1fFM74M";
client_secret_path = secrets."headscale/client_secret".path;
issuer = "https://auth.dtth.ch/application/o/headscale/";
strip_email_domain = true;
};
};
};
environment.etc."headscale/config.yaml".mode = "0644";
virtualisation.arion.projects.headscale-webui.settings = {
services.webui.service = {
image = "ghcr.io/ifargle/headscale-webui@sha256:b4f02337281853648b071301af4329b4e4fc9189d77ced2eb2fbb78204321cab";
restart = "unless-stopped";
environment = {
TZ = "Europe/Zurich";
COLOR = "blue-gray";
HS_SERVER = "https://hs.dtth.ch";
SCRIPT_NAME = "/admin";
};
env_file = [ secrets."headscale/webui-env".path ];
2023-06-01 19:03:00 +00:00
ports = [ "127.0.0.1:${toString webuiPort}:5000" ];
2023-05-04 16:30:55 +00:00
volumes = [
"/var/lib/headscale/webui:/data"
"/etc/headscale:/etc/headscale:ro"
];
};
};
}