From 8e3a2a703f492a8cdf8d94275f5c7dc5f6e2e934 Mon Sep 17 00:00:00 2001 From: sid Date: Sat, 2 May 2026 19:05:53 +0200 Subject: [PATCH 1/2] new tailscale api --- flake.lock | 38 ++++++++++++++--------------- modules/nixos/tailscale/default.nix | 23 ++++++++++++++--- 2 files changed, 38 insertions(+), 23 deletions(-) diff --git a/flake.lock b/flake.lock index b5e2871..e00e855 100644 --- a/flake.lock +++ b/flake.lock @@ -1375,11 +1375,11 @@ ] }, "locked": { - "lastModified": 1775933806, - "narHash": "sha256-rdXTziFNOeL8BWWngh8cmucmDkdfgWPixgZXn3EtYbs=", + "lastModified": 1776736017, + "narHash": "sha256-D3hsaUZLyiJ96d5tknAyS4Uenv6FDZDUTZyr/Jscxg4=", "owner": "tale", "repo": "headplane", - "rev": "418c3bc2556c3197414f462727a2f0545b39907a", + "rev": "4d252833effb13d1cdd48247d513a2afa2f0ad5e", "type": "github" }, "original": { @@ -1906,11 +1906,11 @@ }, "nixpkgs-unstable_2": { "locked": { - "lastModified": 1776169885, - "narHash": "sha256-l/iNYDZ4bGOAFQY2q8y5OAfBBtrDAaPuRQqWaFHVRXM=", + "lastModified": 1776548001, + "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=", "owner": "nixos", "repo": "nixpkgs", - "rev": "4bd9165a9165d7b5e33ae57f3eecbcb28fb231c9", + "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc", "type": "github" }, "original": { @@ -1938,11 +1938,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1776067740, - "narHash": "sha256-B35lpsqnSZwn1Lmz06BpwF7atPgFmUgw1l8KAV3zpVQ=", + "lastModified": 1776734388, + "narHash": "sha256-vl3dkhlE5gzsItuHoEMVe+DlonsK+0836LIRDnm6MXQ=", "owner": "nixos", "repo": "nixpkgs", - "rev": "7e495b747b51f95ae15e74377c5ce1fe69c1765f", + "rev": "10e7ad5bbcb421fe07e3a4ad53a634b0cd57ffac", "type": "github" }, "original": { @@ -2299,11 +2299,11 @@ ] }, "locked": { - "lastModified": 1775585728, - "narHash": "sha256-8Psjt+TWvE4thRKktJsXfR6PA/fWWsZ04DVaY6PUhr4=", + "lastModified": 1776796298, + "narHash": "sha256-PcRvlWayisPSjd0UcRQbhG8Oqw78AcPE6x872cPRHN8=", "owner": "cachix", "repo": "git-hooks.nix", - "rev": "580633fa3fe5fc0379905986543fd7495481913d", + "rev": "3cfd774b0a530725a077e17354fbdb87ea1c4aad", "type": "github" }, "original": { @@ -2354,11 +2354,11 @@ ] }, "locked": { - "lastModified": 1776119890, - "narHash": "sha256-Zm6bxLNnEOYuS/SzrAGsYuXSwk3cbkRQZY0fJnk8a5M=", + "lastModified": 1776771786, + "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=", "owner": "Mic92", "repo": "sops-nix", - "rev": "d4971dd58c6627bfee52a1ad4237637c0a2fb0cd", + "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598", "type": "github" }, "original": { @@ -2519,11 +2519,11 @@ "stylix": "stylix_3" }, "locked": { - "lastModified": 1776284936, - "narHash": "sha256-43Bao4US6hrMevnx2fyKFIlkH8KvKDGghz74cl6s1p8=", + "lastModified": 1777741303, + "narHash": "sha256-zSzzDpJdKhzQbShaAJ+J97kllAQ4nttFr4VMoln2LJo=", "ref": "release-25.11", - "rev": "0c13e9dabd0b573132238b97b634d0ba5e8be830", - "revCount": 28, + "rev": "e801c318a76d147e167ec97342d4d86b302681b8", + "revCount": 35, "type": "git", "url": "https://git.sid.ovh/sid/synix.git" }, diff --git a/modules/nixos/tailscale/default.nix b/modules/nixos/tailscale/default.nix index 10f9bc4..9d2b4f1 100644 --- a/modules/nixos/tailscale/default.nix +++ b/modules/nixos/tailscale/default.nix @@ -1,12 +1,27 @@ -{ inputs, ... }: +{ inputs, config, ... }: { imports = [ inputs.synix.nixosModules.tailscale ]; services.tailscale = { enable = true; - enableSSH = true; - acceptDNS = false; # use coredns - loginServer = "https://hs.sid.ovh"; + tailnets = { + personal = { + default = true; + loginServer = "https://hs.sid.ovh"; + authKeyFile = config.sops.secrets."tailscale/personal-key".path; + enableSSH = true; + acceptDNS = false; # use coredns + }; + work = { + loginServer = "https://headscale.cryodev.xyz"; + enableSSH = true; + acceptDNS = true; + authKeyFile = config.sops.secrets."tailscale/work-key".path; + }; + }; }; + + sops.secrets."tailscale/personal-key" = { }; + sops.secrets."tailscale/work-key" = { }; } From 8e279de754d4a229429a40c87186999952e272ef Mon Sep 17 00:00:00 2001 From: sid Date: Sat, 2 May 2026 19:18:17 +0200 Subject: [PATCH 2/2] new tailscale api --- hosts/rx4/secrets/secrets.yaml | 6 +++--- hosts/sid/secrets/secrets.yaml | 6 +++--- hosts/sid/services/nginx.nix | 32 ++++++++++++++--------------- hosts/sid/services/step-ca.nix | 24 +++++++++++----------- hosts/vde/secrets/secrets.yaml | 8 ++++---- modules/nixos/tailscale/default.nix | 7 ------- 6 files changed, 37 insertions(+), 46 deletions(-) diff --git a/hosts/rx4/secrets/secrets.yaml b/hosts/rx4/secrets/secrets.yaml index 51b3768..0aa47f7 100644 --- a/hosts/rx4/secrets/secrets.yaml +++ b/hosts/rx4/secrets/secrets.yaml @@ -1,5 +1,5 @@ tailscale: - auth-key: ENC[AES256_GCM,data:T4w4IbcQRPYEqAWLE0QhZGG7gx50TN8YPvGvtselFKJruOyW3fTQABQ7vbxJeEw8,iv:/STVNXjA4RHdIXtOn8kq0oke+GS3dD14/RxOdbBRZLQ=,tag:8UNhM6PIPq0LoVO9sYiJQw==,type:str] + personal-key: ENC[AES256_GCM,data:jrB00ICoOe9nlZh51T3Nhp00SnLx4prswMQNx7JMQXd69X/wC/Tkjo3AZgWGjXvg,iv:VWHLJT0+pvWV0nxSX/mlV4R6OzUF+lcZAtmxBZkqQqg=,tag:2GbTw2gdY7cK4biDg3854w==,type:str] alditalk: username: ENC[AES256_GCM,data:QFcW1IIEbALNeagT8Q==,iv:nXDJUPMZc95YSCabTouYqT0Rw5FIlGH/VzizzDr5vmI=,tag:aOqN1bI8lm3dEd1bIEtSew==,type:str] password: ENC[AES256_GCM,data:JP2I4nYQnKpCKL6qyXHc0kVu5Sc=,iv:QsjmGhLHS7FHsWirpYaRrSNvbo1SjjYtzG8F8GeBS6s=,tag:prjUsIG+tk69GKmq2knasw==,type:str] @@ -39,7 +39,7 @@ sops: NE5yK3ZaOG5PdXNSUnlIUmFSSmRFancKk57hCmo79HvI3hzzgQvgOK7oK5/dcQR8 f3R4OGF5+212VXEHR/hAEbKzV7CY4y6HhFyrGZ9bUKm1RrxtnVqUyA== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-03T11:36:39Z" - mac: ENC[AES256_GCM,data:mIufcQyHd6sWnUCF/G8aRE10uwnntRXGz5R+fK6TbZSBJrRznTBaa4tVLtGo4wSghn4eBRfxecebuxSy0C2CQjBCkMbrjh4I2sYzAb5f8ghG4cQZgccuI7MCfQZ6JAEaa0BY7HJUZzlR9H+6iuDVuWwOO3OKzj0lWUlpDA6aC/M=,iv:qMSu9tYYkoirM2WHx7St/ztWSYxm8/gSosnCZYazNgU=,tag:NuUDG8fpAlBEbvKSq7/5bQ==,type:str] + lastmodified: "2026-05-02T17:10:11Z" + mac: ENC[AES256_GCM,data:uf5TqZaevyUUjW6pM6K8c4CZFFdwTXFGIaHmYr5Q4XFR1uW3kBsVLeQKxq26duLuQ4UiZkUpW27a/PW797Z+iIpBdqbnoQ35q7RnOW+GpnAv8TaRW1PpqQ+JR3/R0LMXsi3cMt7ioG2ad1bIHztiNz+SmePiv3Yt9WxQ7PIqBdY=,iv:dAzuyKSo0OW+j02AH0chCdLBm7Wv6PZgqZrEWhEVnxQ=,tag:k6EKWHHY4fwTd03d4TVcNg==,type:str] unencrypted_suffix: _unencrypted version: 3.12.1 diff --git a/hosts/sid/secrets/secrets.yaml b/hosts/sid/secrets/secrets.yaml index 372dccc..8fb0e4a 100644 --- a/hosts/sid/secrets/secrets.yaml +++ b/hosts/sid/secrets/secrets.yaml @@ -21,7 +21,7 @@ headplane: livekit: key: ENC[AES256_GCM,data:QgD9fg6KvY/fGVdYVT9Oks/NkXm26oZaBUiVNpPCm0pvtVbzoiTv5BY9Krk=,iv:ayYBfr8s2MSD1EU809K6XGlP6dLcQVJC5vmscpqb2I4=,tag:juYtwZfUa7IV1Qcc+HnYnA==,type:str] tailscale: - auth-key: ENC[AES256_GCM,data:BhCC0J0DmVaNAQmPo8I1a+0iBTUsZxBhXQlds2SIT5O/Daf2HGYsaGRg3IhVQmoK,iv:ws9B1V0JyfGyamTmc/pMOkMli1kcgKv6xLwXx6XB+r8=,tag:5KmqglMES7XlotIgQX2sdg==,type:str] + personal-key: ENC[AES256_GCM,data:YhUV1uSCXTE40xf4H9G1enxSll+pWSapbEifkK7rlBluDm+fIb3DtDXcWL+qyc9L,iv:tGzcTZQJm9OLAp9JhrL1pCqACKPFlO0qX0s5o0YT9MY=,tag:K34qSZajZ2XwmJeW1NAYNQ==,type:str] netdata: stream: rx4: @@ -55,7 +55,7 @@ sops: RzhnczA0S1pxcXZncGpWVHNYQW96L28K+ytH3PPyg4+wibpAQhp02RiSfZ83EDRB UJ8UV1d+51D0e2A1sI95r2AzDj4jfwUnI+LYDPC/qEpsu5LFLGVyeg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-04-18T20:48:28Z" - mac: ENC[AES256_GCM,data:RDhfanP4bN68/gVivoDxxOI4r/Pdov4qI/dldmC+RBHg1kzwJsneLxEHS2KEQhtXwR8y22WJ62pIgLA7WZHdCSIqL6cbJ4V8ImQmlJHYVnaGrkgFdbzUFi8B15jRwHTywhC3+CdxoeppzGFFCUnHDbPWVfDaVXmgHeHRPJoQHck=,iv:+pAAtvwPJz0PRIeywt9GhQL8P57cCy6hhOgoUGjIexc=,tag:d7h2XdPmkdnJd9j65llFsw==,type:str] + lastmodified: "2026-05-02T17:10:22Z" + mac: ENC[AES256_GCM,data:f4KQ26/zvg2nLLeW5qVeI8uH2GmPpJUKohNu68nEiIjP5AT53zjBaGoLOTGl9+oVRomSOGZtLGkJGaExB6tLMon5HN6xkQbugqvq08UkZ7FnR1Sa8/OtTr/+eexPNzF8VSdZE2TZCboUSQODV8+0Cy5T918g5kedxnT62SyY4As=,iv:P4TnpJvHwnZPl7kRNjv9d1WLZP9J0sg6R3KbdDMJqyc=,tag:ylYOcg6825jT29lWUaFRYA==,type:str] unencrypted_suffix: _unencrypted version: 3.12.1 diff --git a/hosts/sid/services/nginx.nix b/hosts/sid/services/nginx.nix index 2619671..ca44b46 100644 --- a/hosts/sid/services/nginx.nix +++ b/hosts/sid/services/nginx.nix @@ -19,11 +19,12 @@ in enable = true; openFirewall = true; forceSSL = ssl; - virtualHosts."${constants.ca-fqdn}" = { - locations."/.well-known/acme-challenge/" = { - root = "/var/lib/acme/acme-challenge"; - }; - }; + # virtualHosts."*" = { + # forceSSL = false; + # locations."/.well-known/acme-challenge/" = { + # root = "/var/lib/acme/acme-challenge"; + # }; + # }; virtualHosts."${constants.services.docs.fqdn}" = mkVirtualHost { inherit ssl; address = constants.hosts.rx4.ip; @@ -60,18 +61,15 @@ in address = constants.hosts.rx4.ip; port = constants.services.rsshub-oci.port; }; - virtualHosts."${constants.services.vaultwarden.fqdn}" = { - useACMEHost = "sid-internal"; - forceSSL = ssl; - locations = { - "/" = { - proxyPass = "http://${constants.hosts.rx4.ip}:${toString constants.services.vaultwarden.port}"; - }; - "/.well-known/acme-challenge/" = { - root = "/var/lib/acme/acme-challenge"; - }; - }; - }; + # virtualHosts."${constants.services.vaultwarden.fqdn}" = { + # useACMEHost = "sid-internal"; + # forceSSL = ssl; + # locations = { + # "/" = { + # proxyPass = "http://${constants.hosts.rx4.ip}:${toString constants.services.vaultwarden.port}"; + # }; + # }; + # }; # virtualHosts."${constants.services.webdav.fqdn}" = mkVirtualHost { # inherit ssl; # address = constants.hosts.rx4.ip; diff --git a/hosts/sid/services/step-ca.nix b/hosts/sid/services/step-ca.nix index 685c07b..1f3ec53 100644 --- a/hosts/sid/services/step-ca.nix +++ b/hosts/sid/services/step-ca.nix @@ -75,18 +75,18 @@ in "d /var/lib/acme/acme-challenge 0755 acme nginx" ]; - security.acme = { - certs."sid-internal" = { - domain = constants.intranet; - extraDomainNames = [ - # constants.services.netdata.fqdn - constants.services.vaultwarden.fqdn - # constants.services.webdav.fqdn - ]; - server = "https://${constants.ca-fqdn}:${toString cfg.port}/acme/acme/directory"; - group = "nginx"; - }; - }; + # security.acme = { + # certs."sid-internal" = { + # domain = constants.services.vaultwarden.fqdn; + # # extraDomainNames = [ + # # constants.services.netdata.fqdn + # # constants.services.vaultwarden.fqdn + # # constants.services.webdav.fqdn + # # ]; + # server = "https://${constants.ca-fqdn}:${toString cfg.port}/acme/acme/directory"; + # group = "nginx"; + # }; + # }; sops = let diff --git a/hosts/vde/secrets/secrets.yaml b/hosts/vde/secrets/secrets.yaml index 73ebd46..594a47e 100644 --- a/hosts/vde/secrets/secrets.yaml +++ b/hosts/vde/secrets/secrets.yaml @@ -1,5 +1,5 @@ tailscale: - auth-key: ENC[AES256_GCM,data:Fz1XGaQXERn+3EymtWyq9oYqoX0KrcPJelda+addeX+vhqEAxRe5jRdzK8W6329b,iv:HNlz5f7dscDXsPoKZjSiIl2NZOouEJZyzU3kaiX1NUw=,tag:DdIxWKeZ9kfHUkh0/l1sEw==,type:str] + personal-key: ENC[AES256_GCM,data:SwTmCDexL/ka3z4f2oZrUF8hqi4H5v1yBAsIOVyxZMfLTUNFOJCrApzPmULegKJ1,iv:aldDceyZfCMH+ke+cKaqJRV95qR2vuMlUMs5BpzkxAs=,tag:lgfizsBnYWfIGnQbRxOmnw==,type:str] sops: age: - recipient: age19yeqvv28fgrtk6jsh3xyaf0lch86kna6rcz4dwe962yyyyevu30sx474xy @@ -20,7 +20,7 @@ sops: RjlIQWVIcTY0aUlhelorMDRycVZnOEkK69ZCxeh8IL2LcsjgkBgbIbC6XnDJ8zwd yCuPYXkYOxeitToIbhHQS4TbgF61/tJqIixqoIe3vG+o112UspGkoQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-01-12T20:15:19Z" - mac: ENC[AES256_GCM,data:sDbfLjm6ZqkVUMNbB6ikMSlMiXd9Ukf2K8HdAF66JwPB+KQI/rqIRKiSaOEKJ8p1AvpEr86ENlCEZNeslQJAdlqbGy6+VOcbSAz2bfhhXfThaAEgYT9CmXAsJL8lWMI5N2Ti0kiepjk+nMG1bbFyPecHm4AqadMRC/RHprAK4fc=,iv:2UPmmBNATuXvk+LbF9Lwi7Cgi0OFMHr96ONG6bpBDpY=,tag:i5If1ui4XHeuE7BjUEHUCA==,type:str] + lastmodified: "2026-05-02T17:10:03Z" + mac: ENC[AES256_GCM,data:EiIdKqsP93FN/X6V0kRc+kL6+Nu/BxYBi9Z6g7vUm2rAnimfasTvDamjKXC3bEJDWFpmoGfmYKRERGL+Cr26Kzcoue9NtP2jP9Vnb6De8LcZu1PQufs304adgaHBb1Eb5LtjC6J6EyZLK45OGqcscZjHK4vKxFimpeOXcd6EG+4=,iv:myMH3ubkxg+iNrEifQOSTzRWzEHsg04rZmH2pgxOz7o=,tag:CjrwtgPFfgXN88hR/s9OsA==,type:str] unencrypted_suffix: _unencrypted - version: 3.11.0 + version: 3.12.1 diff --git a/modules/nixos/tailscale/default.nix b/modules/nixos/tailscale/default.nix index 9d2b4f1..884847a 100644 --- a/modules/nixos/tailscale/default.nix +++ b/modules/nixos/tailscale/default.nix @@ -13,15 +13,8 @@ enableSSH = true; acceptDNS = false; # use coredns }; - work = { - loginServer = "https://headscale.cryodev.xyz"; - enableSSH = true; - acceptDNS = true; - authKeyFile = config.sops.secrets."tailscale/work-key".path; - }; }; }; sops.secrets."tailscale/personal-key" = { }; - sops.secrets."tailscale/work-key" = { }; }