86 lines
2.3 KiB
Nix
86 lines
2.3 KiB
Nix
{ pkgs, config, lib, ... }:
|
|
let
|
|
secrets = config.sops.secrets;
|
|
|
|
host = "hs.dtth.ch";
|
|
port = 19876;
|
|
webuiPort = 19877;
|
|
in
|
|
rec {
|
|
sops.secrets."headscale/client_secret" = { owner = "headscale"; };
|
|
sops.secrets."headscale/webui-env" = { };
|
|
sops.secrets."headscale/derp-servers/vnm" = { owner = "headscale"; name = "headscale/derp-servers/vnm.yaml"; };
|
|
# database
|
|
cloud.postgresql.databases = [ "headscale" ];
|
|
# traefik
|
|
cloud.traefik.hosts.headscale = {
|
|
inherit port host;
|
|
filter = "Host(`hs.dtth.ch`) && !PathPrefix(`/admin`)";
|
|
};
|
|
cloud.traefik.hosts.headscale_webui = {
|
|
inherit host;
|
|
port = webuiPort;
|
|
filter = "Host(`hs.dtth.ch`) && PathPrefix(`/admin`)";
|
|
};
|
|
|
|
services.headscale = {
|
|
enable = true;
|
|
inherit port;
|
|
|
|
settings = {
|
|
server_url = "https://hs.dtth.ch";
|
|
|
|
db_type = "postgres";
|
|
db_host = "/var/run/postgresql"; # find out yourself
|
|
db_user = "headscale";
|
|
db_name = "headscale";
|
|
|
|
dns_config = {
|
|
base_domain = host;
|
|
};
|
|
|
|
noise = {
|
|
private_key_path = "/var/lib/headscale/noise_private.key";
|
|
};
|
|
|
|
ip_prefixes = [
|
|
"fd7a:115c:a1e0::/48"
|
|
"100.64.0.0/10"
|
|
];
|
|
|
|
derp.paths = [
|
|
secrets."headscale/derp-servers/vnm".path
|
|
];
|
|
|
|
oidc = {
|
|
only_start_if_oidc_is_available = true;
|
|
client_id = "XgHLi5CC7mbW6xF8wuOHq3xxCPagSUaHt1fFM74M";
|
|
client_secret_path = secrets."headscale/client_secret".path;
|
|
issuer = "https://auth.dtth.ch/application/o/headscale/";
|
|
strip_email_domain = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
environment.etc."headscale/config.yaml".mode = "0644";
|
|
virtualisation.arion.projects.headscale-webui.settings = {
|
|
services.webui.service = {
|
|
image = "ghcr.io/ifargle/headscale-webui@sha256:b4f02337281853648b071301af4329b4e4fc9189d77ced2eb2fbb78204321cab";
|
|
restart = "unless-stopped";
|
|
|
|
environment = {
|
|
TZ = "Europe/Zurich";
|
|
COLOR = "blue-gray";
|
|
HS_SERVER = "https://hs.dtth.ch";
|
|
SCRIPT_NAME = "/admin";
|
|
};
|
|
env_file = [ secrets."headscale/webui-env".path ];
|
|
ports = [ "127.0.0.1:${toString webuiPort}:5000" ];
|
|
volumes = [
|
|
"/var/lib/headscale/webui:/data"
|
|
"/etc/headscale:/etc/headscale:ro"
|
|
];
|
|
};
|
|
};
|
|
}
|