sid/sid.ovh
1
0
Fork 0
Code Issues 3 Pull requests 2 Projects Releases Packages Wiki Activity Actions

new tailscale api
All checks were successful
Flake check / flake-check (pull_request) Successful in 17s
Details
Build hosts / build-hosts (pull_request) Successful in 27s
Details

Browse source
This commit is contained in:
sid 2026-05-02 19:18:17 +02:00
parent 8e3a2a703f
commit 8e279de754
6 changed files with 37 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

6
hosts/rx4/secrets/secrets.yaml
View file

@ -1,5 +1,5 @@
tailscale: tailscale:
auth-key: ENC[AES256_GCM,data:T4w4IbcQRPYEqAWLE0QhZGG7gx50TN8YPvGvtselFKJruOyW3fTQABQ7vbxJeEw8,iv:/STVNXjA4RHdIXtOn8kq0oke+GS3dD14/RxOdbBRZLQ=,tag:8UNhM6PIPq0LoVO9sYiJQw==,type:str] personal-key: ENC[AES256_GCM,data:jrB00ICoOe9nlZh51T3Nhp00SnLx4prswMQNx7JMQXd69X/wC/Tkjo3AZgWGjXvg,iv:VWHLJT0+pvWV0nxSX/mlV4R6OzUF+lcZAtmxBZkqQqg=,tag:2GbTw2gdY7cK4biDg3854w==,type:str]
alditalk: alditalk:
username: ENC[AES256_GCM,data:QFcW1IIEbALNeagT8Q==,iv:nXDJUPMZc95YSCabTouYqT0Rw5FIlGH/VzizzDr5vmI=,tag:aOqN1bI8lm3dEd1bIEtSew==,type:str] username: ENC[AES256_GCM,data:QFcW1IIEbALNeagT8Q==,iv:nXDJUPMZc95YSCabTouYqT0Rw5FIlGH/VzizzDr5vmI=,tag:aOqN1bI8lm3dEd1bIEtSew==,type:str]
password: ENC[AES256_GCM,data:JP2I4nYQnKpCKL6qyXHc0kVu5Sc=,iv:QsjmGhLHS7FHsWirpYaRrSNvbo1SjjYtzG8F8GeBS6s=,tag:prjUsIG+tk69GKmq2knasw==,type:str] password: ENC[AES256_GCM,data:JP2I4nYQnKpCKL6qyXHc0kVu5Sc=,iv:QsjmGhLHS7FHsWirpYaRrSNvbo1SjjYtzG8F8GeBS6s=,tag:prjUsIG+tk69GKmq2knasw==,type:str]
@ -39,7 +39,7 @@ sops:
NE5yK3ZaOG5PdXNSUnlIUmFSSmRFancKk57hCmo79HvI3hzzgQvgOK7oK5/dcQR8 NE5yK3ZaOG5PdXNSUnlIUmFSSmRFancKk57hCmo79HvI3hzzgQvgOK7oK5/dcQR8
f3R4OGF5+212VXEHR/hAEbKzV7CY4y6HhFyrGZ9bUKm1RrxtnVqUyA== f3R4OGF5+212VXEHR/hAEbKzV7CY4y6HhFyrGZ9bUKm1RrxtnVqUyA==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2026-04-03T11:36:39Z" lastmodified: "2026-05-02T17:10:11Z"
mac: ENC[AES256_GCM,data:mIufcQyHd6sWnUCF/G8aRE10uwnntRXGz5R+fK6TbZSBJrRznTBaa4tVLtGo4wSghn4eBRfxecebuxSy0C2CQjBCkMbrjh4I2sYzAb5f8ghG4cQZgccuI7MCfQZ6JAEaa0BY7HJUZzlR9H+6iuDVuWwOO3OKzj0lWUlpDA6aC/M=,iv:qMSu9tYYkoirM2WHx7St/ztWSYxm8/gSosnCZYazNgU=,tag:NuUDG8fpAlBEbvKSq7/5bQ==,type:str] mac: ENC[AES256_GCM,data:uf5TqZaevyUUjW6pM6K8c4CZFFdwTXFGIaHmYr5Q4XFR1uW3kBsVLeQKxq26duLuQ4UiZkUpW27a/PW797Z+iIpBdqbnoQ35q7RnOW+GpnAv8TaRW1PpqQ+JR3/R0LMXsi3cMt7ioG2ad1bIHztiNz+SmePiv3Yt9WxQ7PIqBdY=,iv:dAzuyKSo0OW+j02AH0chCdLBm7Wv6PZgqZrEWhEVnxQ=,tag:k6EKWHHY4fwTd03d4TVcNg==,type:str]
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.12.1 version: 3.12.1

6
hosts/sid/secrets/secrets.yaml
View file

@ -21,7 +21,7 @@ headplane:
livekit: livekit:
key: ENC[AES256_GCM,data:QgD9fg6KvY/fGVdYVT9Oks/NkXm26oZaBUiVNpPCm0pvtVbzoiTv5BY9Krk=,iv:ayYBfr8s2MSD1EU809K6XGlP6dLcQVJC5vmscpqb2I4=,tag:juYtwZfUa7IV1Qcc+HnYnA==,type:str] key: ENC[AES256_GCM,data:QgD9fg6KvY/fGVdYVT9Oks/NkXm26oZaBUiVNpPCm0pvtVbzoiTv5BY9Krk=,iv:ayYBfr8s2MSD1EU809K6XGlP6dLcQVJC5vmscpqb2I4=,tag:juYtwZfUa7IV1Qcc+HnYnA==,type:str]
tailscale: tailscale:
auth-key: ENC[AES256_GCM,data:BhCC0J0DmVaNAQmPo8I1a+0iBTUsZxBhXQlds2SIT5O/Daf2HGYsaGRg3IhVQmoK,iv:ws9B1V0JyfGyamTmc/pMOkMli1kcgKv6xLwXx6XB+r8=,tag:5KmqglMES7XlotIgQX2sdg==,type:str] personal-key: ENC[AES256_GCM,data:YhUV1uSCXTE40xf4H9G1enxSll+pWSapbEifkK7rlBluDm+fIb3DtDXcWL+qyc9L,iv:tGzcTZQJm9OLAp9JhrL1pCqACKPFlO0qX0s5o0YT9MY=,tag:K34qSZajZ2XwmJeW1NAYNQ==,type:str]
netdata: netdata:
stream: stream:
rx4: rx4:
@ -55,7 +55,7 @@ sops:
RzhnczA0S1pxcXZncGpWVHNYQW96L28K+ytH3PPyg4+wibpAQhp02RiSfZ83EDRB RzhnczA0S1pxcXZncGpWVHNYQW96L28K+ytH3PPyg4+wibpAQhp02RiSfZ83EDRB
UJ8UV1d+51D0e2A1sI95r2AzDj4jfwUnI+LYDPC/qEpsu5LFLGVyeg== UJ8UV1d+51D0e2A1sI95r2AzDj4jfwUnI+LYDPC/qEpsu5LFLGVyeg==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2026-04-18T20:48:28Z" lastmodified: "2026-05-02T17:10:22Z"
mac: ENC[AES256_GCM,data:RDhfanP4bN68/gVivoDxxOI4r/Pdov4qI/dldmC+RBHg1kzwJsneLxEHS2KEQhtXwR8y22WJ62pIgLA7WZHdCSIqL6cbJ4V8ImQmlJHYVnaGrkgFdbzUFi8B15jRwHTywhC3+CdxoeppzGFFCUnHDbPWVfDaVXmgHeHRPJoQHck=,iv:+pAAtvwPJz0PRIeywt9GhQL8P57cCy6hhOgoUGjIexc=,tag:d7h2XdPmkdnJd9j65llFsw==,type:str] mac: ENC[AES256_GCM,data:f4KQ26/zvg2nLLeW5qVeI8uH2GmPpJUKohNu68nEiIjP5AT53zjBaGoLOTGl9+oVRomSOGZtLGkJGaExB6tLMon5HN6xkQbugqvq08UkZ7FnR1Sa8/OtTr/+eexPNzF8VSdZE2TZCboUSQODV8+0Cy5T918g5kedxnT62SyY4As=,iv:P4TnpJvHwnZPl7kRNjv9d1WLZP9J0sg6R3KbdDMJqyc=,tag:ylYOcg6825jT29lWUaFRYA==,type:str]
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.12.1 version: 3.12.1

32
hosts/sid/services/nginx.nix
View file

@ -19,11 +19,12 @@ in
enable = true; enable = true;
openFirewall = true; openFirewall = true;
forceSSL = ssl; forceSSL = ssl;
virtualHosts."${constants.ca-fqdn}" = { # virtualHosts."*" = {
locations."/.well-known/acme-challenge/" = { # forceSSL = false;
root = "/var/lib/acme/acme-challenge"; # locations."/.well-known/acme-challenge/" = {
}; # root = "/var/lib/acme/acme-challenge";
}; # };
# };
virtualHosts."${constants.services.docs.fqdn}" = mkVirtualHost { virtualHosts."${constants.services.docs.fqdn}" = mkVirtualHost {
inherit ssl; inherit ssl;
address = constants.hosts.rx4.ip; address = constants.hosts.rx4.ip;
@ -60,18 +61,15 @@ in
address = constants.hosts.rx4.ip; address = constants.hosts.rx4.ip;
port = constants.services.rsshub-oci.port; port = constants.services.rsshub-oci.port;
}; };
virtualHosts."${constants.services.vaultwarden.fqdn}" = { # virtualHosts."${constants.services.vaultwarden.fqdn}" = {
useACMEHost = "sid-internal"; # useACMEHost = "sid-internal";
forceSSL = ssl; # forceSSL = ssl;
locations = { # locations = {
"/" = { # "/" = {
proxyPass = "http://${constants.hosts.rx4.ip}:${toString constants.services.vaultwarden.port}"; # proxyPass = "http://${constants.hosts.rx4.ip}:${toString constants.services.vaultwarden.port}";
}; # };
"/.well-known/acme-challenge/" = { # };
root = "/var/lib/acme/acme-challenge"; # };
};
};
};
# virtualHosts."${constants.services.webdav.fqdn}" = mkVirtualHost { # virtualHosts."${constants.services.webdav.fqdn}" = mkVirtualHost {
# inherit ssl; # inherit ssl;
# address = constants.hosts.rx4.ip; # address = constants.hosts.rx4.ip;

24
hosts/sid/services/step-ca.nix
View file

@ -75,18 +75,18 @@ in
"d /var/lib/acme/acme-challenge 0755 acme nginx" "d /var/lib/acme/acme-challenge 0755 acme nginx"
]; ];
security.acme = { # security.acme = {
certs."sid-internal" = { # certs."sid-internal" = {
domain = constants.intranet; # domain = constants.services.vaultwarden.fqdn;
extraDomainNames = [ # # extraDomainNames = [
# constants.services.netdata.fqdn # # constants.services.netdata.fqdn
constants.services.vaultwarden.fqdn # # constants.services.vaultwarden.fqdn
# constants.services.webdav.fqdn # # constants.services.webdav.fqdn
]; # # ];
server = "https://${constants.ca-fqdn}:${toString cfg.port}/acme/acme/directory"; # server = "https://${constants.ca-fqdn}:${toString cfg.port}/acme/acme/directory";
group = "nginx"; # group = "nginx";
}; # };
}; # };
sops = sops =
let let

8
hosts/vde/secrets/secrets.yaml
View file

@ -1,5 +1,5 @@
tailscale: tailscale:
auth-key: ENC[AES256_GCM,data:Fz1XGaQXERn+3EymtWyq9oYqoX0KrcPJelda+addeX+vhqEAxRe5jRdzK8W6329b,iv:HNlz5f7dscDXsPoKZjSiIl2NZOouEJZyzU3kaiX1NUw=,tag:DdIxWKeZ9kfHUkh0/l1sEw==,type:str] personal-key: ENC[AES256_GCM,data:SwTmCDexL/ka3z4f2oZrUF8hqi4H5v1yBAsIOVyxZMfLTUNFOJCrApzPmULegKJ1,iv:aldDceyZfCMH+ke+cKaqJRV95qR2vuMlUMs5BpzkxAs=,tag:lgfizsBnYWfIGnQbRxOmnw==,type:str]
sops: sops:
age: age:
- recipient: age19yeqvv28fgrtk6jsh3xyaf0lch86kna6rcz4dwe962yyyyevu30sx474xy - recipient: age19yeqvv28fgrtk6jsh3xyaf0lch86kna6rcz4dwe962yyyyevu30sx474xy
@ -20,7 +20,7 @@ sops:
RjlIQWVIcTY0aUlhelorMDRycVZnOEkK69ZCxeh8IL2LcsjgkBgbIbC6XnDJ8zwd RjlIQWVIcTY0aUlhelorMDRycVZnOEkK69ZCxeh8IL2LcsjgkBgbIbC6XnDJ8zwd
yCuPYXkYOxeitToIbhHQS4TbgF61/tJqIixqoIe3vG+o112UspGkoQ== yCuPYXkYOxeitToIbhHQS4TbgF61/tJqIixqoIe3vG+o112UspGkoQ==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2026-01-12T20:15:19Z" lastmodified: "2026-05-02T17:10:03Z"
mac: ENC[AES256_GCM,data:sDbfLjm6ZqkVUMNbB6ikMSlMiXd9Ukf2K8HdAF66JwPB+KQI/rqIRKiSaOEKJ8p1AvpEr86ENlCEZNeslQJAdlqbGy6+VOcbSAz2bfhhXfThaAEgYT9CmXAsJL8lWMI5N2Ti0kiepjk+nMG1bbFyPecHm4AqadMRC/RHprAK4fc=,iv:2UPmmBNATuXvk+LbF9Lwi7Cgi0OFMHr96ONG6bpBDpY=,tag:i5If1ui4XHeuE7BjUEHUCA==,type:str] mac: ENC[AES256_GCM,data:EiIdKqsP93FN/X6V0kRc+kL6+Nu/BxYBi9Z6g7vUm2rAnimfasTvDamjKXC3bEJDWFpmoGfmYKRERGL+Cr26Kzcoue9NtP2jP9Vnb6De8LcZu1PQufs304adgaHBb1Eb5LtjC6J6EyZLK45OGqcscZjHK4vKxFimpeOXcd6EG+4=,iv:myMH3ubkxg+iNrEifQOSTzRWzEHsg04rZmH2pgxOz7o=,tag:CjrwtgPFfgXN88hR/s9OsA==,type:str]
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.11.0 version: 3.12.1

7
modules/nixos/tailscale/default.nix
View file

@ -13,15 +13,8 @@
enableSSH = true; enableSSH = true;
acceptDNS = false; # use coredns acceptDNS = false; # use coredns
}; };
work = {
loginServer = "https://headscale.cryodev.xyz";
enableSSH = true;
acceptDNS = true;
authKeyFile = config.sops.secrets."tailscale/work-key".path;
};
}; };
}; };
sops.secrets."tailscale/personal-key" = { }; sops.secrets."tailscale/personal-key" = { };
sops.secrets."tailscale/work-key" = { };
} }