Newer
Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
{ pkgs, config, lib, ... }:
let
unstable = import (
builtins.fetchTarball {
url = "https://github.com/NixOS/nixpkgs/archive/7fa76be757c8d9feaecb984d8bc0b3b13e40545f.tar.gz";
sha256 = "0whjrnfz0n1rbr84ykzp1nqnmsn7d9lpj1h4q76w1kxzx50rqg9r";
}
) {};
tailscale = unstable.tailscale;
tailscale-cert-service = certName: conf: {
serviceConfig = {
type = "oneshot";
};
wants = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
requires = [ "tailscaled.service" ];
after = [ "tailscaled.service" ];
script = let
cert-dir = conf.directory;
group = conf.group;
in
''
set -euxo pipefail
${tailscale}/bin/tailscale cert --cert-file ${cert-dir}/fullchain.pem --key-file ${cert-dir}/key.pem ${certName}
chgrp ${group} ${cert-dir}/fullchain.pem ${cert-dir}/key.pem
chmod g+r ${cert-dir}/fullchain.pem ${cert-dir}/key.pem
'';
};
in
{
services.tailscale.enable = true;
services.tailscale.package = tailscale;
virtualisation.graphics = false;
virtualisation.qemu.options = [
"-virtfs local,path=/root/persist/${config.networking.hostName},security_model=none,mount_tag=persist"
];
virtualisation.fileSystems."/persist" = let
cfg = config.virtualisation;
in
{
device = "persist";
fsType = "9p";
neededForBoot = true;
options = [ "trans=virtio" "version=9p2000.L" ] ++ lib.optional (cfg.msize != null) "msize=${toString cfg.msize}";
};
systemd.tmpfiles.rules = [
"d /persist/tailscale 0700 root root -"
"d /persist/ssh 0700 root root -"
];
services.openssh = {
hostKeys = [
{
path = "/persist/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
];
};
systemd.services = lib.mapAttrs' (cert: conf: lib.nameValuePair "acme-${cert}" (lib.mkForce (tailscale-cert-service cert conf))) config.security.acme.certs
// {
tailscaled = {
serviceConfig.BindPaths = [ "/persist/tailscale:/var/lib/tailscale" ];
environment = {
TS_DEBUG_RESTUN_STOP_ON_IDLE = "true";
};
};
};
}