sid/sid.ovh
1
0
Fork 0
Code Issues 3 Pull requests 2 Projects Releases Packages Wiki Activity Actions

testing tailnet ssl #12

Merged
sid merged 1 commit from develop into master 2026-04-03 14:15:36 +02:00
Conversation 0 Commits 1 Files changed 3 +38 -12
3 changed files with 38 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit b971881b2a - Show all commits

3
constants.nix
View file

@ -3,12 +3,15 @@ rec {
hosts = { hosts = {
sid = { sid = {
ip = "100.64.0.6"; ip = "100.64.0.6";
domain = "sid.tail";
}; };
rx4 = { rx4 = {
ip = "100.64.0.10"; ip = "100.64.0.10";
domain = "rx4.tail";
}; };
vde = { vde = {
ip = "100.64.0.1"; ip = "100.64.0.1";
domain = "vde.tail";
}; };
}; };
services = { services = {

23
hosts/sid/services/headscale.nix
View file

@ -1,10 +1,9 @@
{ {
inputs, inputs,
constants,
... ...
}: }:
# TODO: use constants.nix
{ {
imports = [ imports = [
inputs.synix.nixosModules.headplane inputs.synix.nixosModules.headplane
@ -14,20 +13,20 @@
services.resolved.enable = false; services.resolved.enable = false;
networking.resolvconf.enable = false; networking.resolvconf.enable = false;
networking.nameservers = [ "100.64.0.6" ]; networking.nameservers = [ constants.hosts.sid.ip ];
services.coredns = { services.coredns = {
enable = true; enable = true;
config = '' config = with constants; ''
.:53 { .:53 {
bind 100.64.0.6 bind ${hosts.sid.ip}
hosts { hosts {
100.64.0.6 sid.tail ${hosts.sid.ip} sid.tail
100.64.0.6 netdata.sid.tail ${hosts.sid.ip} netdata.sid.tail
100.64.0.10 rx4.tail ${hosts.rx4.ip} rx4.tail
100.64.0.10 dav.rx4.tail ${hosts.rx4.ip} dav.rx4.tail
100.64.0.10 pw.rx4.tail ${hosts.rx4.ip} pw.rx4.tail
100.64.0.1 vde.tail ${hosts.vde.ip} vde.tail
fallthrough fallthrough
} }
forward . 1.1.1.1 forward . 1.1.1.1
@ -62,7 +61,7 @@
nameservers = { nameservers = {
global = [ "1.1.1.1" ]; global = [ "1.1.1.1" ];
split = { split = {
"tail" = [ "100.64.0.6" ]; "tail" = [ constants.hosts.sid.ip ];
}; };
}; };
}; };

24
hosts/sid/services/nginx.nix
View file

@ -1,5 +1,6 @@
{ {
inputs, inputs,
config,
constants, constants,
lib, lib,
... ...
@ -15,10 +16,33 @@ in
inputs.synix.nixosModules.nginx inputs.synix.nixosModules.nginx
]; ];
users.users.nginx.extraGroups = [ "tailscale" ];
systemd.services.nginx.serviceConfig = {
SupplementaryGroups = [ "tailscale" ];
Requires = [ "tailscaled.service" ];
After = [ "tailscaled.service" ];
};
systemd.services."generate-tailscale-certs-${constants.hosts.sid.domain}" = {
wantedBy = [ "multi-user.target" ];
before = [ "nginx.service" ];
after = [ "tailscaled.service" ];
serviceConfig = {
Type = "oneshot";
ExecStart = "${config.services.tailscale.package}/bin/tailscale cert ${constants.hosts.sid.domain}";
User = "root";
};
};
services.nginx = { services.nginx = {
enable = true; enable = true;
openFirewall = true; openFirewall = true;
forceSSL = ssl; forceSSL = ssl;
virtualHosts."${constants.hosts.sid.domain}" = {
sslCertificate = "/var/lib/tailscale/certs/${constants.hosts.sid.domain}.crt";
sslCertificateKey = "/var/lib/tailscale/certs/${constants.hosts.sid.domain}.key";
forceSSL = true;
};
virtualHosts."${constants.services.docs.fqdn}" = mkVirtualHost { virtualHosts."${constants.services.docs.fqdn}" = mkVirtualHost {
inherit ssl; inherit ssl;
address = constants.hosts.rx4.ip; address = constants.hosts.rx4.ip;