gensokyo-zone/infrastructure
1
0
Fork 0
mirror of https://github.com/gensokyo-zone/infrastructure.git synced 2026-02-09 12:29:19 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: reisen containers

Browse source
This commit is contained in:
arcnmx 2024-01-06 14:45:38 -08:00
parent df7b0595a3
commit c725df2591
16 changed files with 238 additions and 64 deletions
Download patch file Download diff file Expand all files Collapse all files

50
modules/nixos/network.nix
View file

@ -11,55 +11,5 @@ with lib; {
};
config = {
deploy.system = config.system.build.toplevel;
networking.domain = "inskip.me";
networking.firewall = {
trustedInterfaces = [config.services.tailscale.interfaceName];
allowedUDPPorts = [config.services.tailscale.port];
};
systemd.network = {
wait-online.ignoredInterfaces = [config.services.tailscale.interfaceName];
networks."50-tailscale" = {
networkConfig = {
DNSDefaultRoute = false;
};
};
};
services.tailscale.enable = true;
sops.secrets.tailscale-key = { };
systemd.services.tailscale-autoconnect = mkIf config.services.tailscale.enable rec {
description = "Automatic connection to Tailscale";
# make sure tailscale is running before trying to connect to tailscale
after = wants ++ wantedBy;
wants = [ "network-pre.target" ];
wantedBy = [ "tailscaled.service" ];
# set this service as a oneshot job
serviceConfig = {
Type = "oneshot";
};
# have the job run this shell script
script = with pkgs; ''
# wait for tailscaled to settle
sleep 5
resolvectl revert ${config.services.tailscale.interfaceName} || false
# check if we are already authenticated to tailscale
status="$(${getExe tailscale} status -json | ${getExe jq} -r .BackendState)"
if [[ $status = Running ]]; then
# if so, then do nothing
exit 0
fi
# otherwise authenticate with tailscale
${getExe tailscale} up --advertise-exit-node -authkey $(cat ${config.sops.secrets.tailscale-key.path})
'';
};
};
}