Reorganize services/ into category subfolders

Group service modules by category (media, network, vpn, identity, dev, desktop) to make the growing services/ dir easier to navigate. containers.nix stays at the top level since it's a shared backend, not a single-category service. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-20 06:08:43 +02:00
parent 4679afa505
commit d7a66f3e3b
27 changed files with 41 additions and 38 deletions
@@ -0,0 +1,39 @@
+{ config, ... }:
+
+# Headplane — web UI for headscale (services/vpn/headscale.nix; must be enabled
+# first). Runs as headscale's own OS user so it can restart headscale when
+# settings change from the UI.
+#
+# Served at vpn.mgaction.town/admin (path-routed alongside headscale itself,
+# see hosts/neptun/configuration.nix). base_url is the site root WITHOUT the
+# /admin prefix — Headplane appends that itself, including for the OIDC
+# callback.
+#
+# Auth is Zitadel (services/identity/zitadel.nix) via OIDC. client_id, client_secret,
+# and the headscale API key can't be known until Zitadel/headscale are
+# actually deployed, so they're placeholders below; direct API-key login
+# still works as a fallback until then. Once live:
+#   1. In Zitadel: create a project + a Web application for Headplane, with
+#      redirect URI https://vpn.mgaction.town/admin/oidc/callback. Copy the
+#      generated client ID into oidc.client_id below.
+#   2. `./scripts/edit_secrets secrets/neptun.yaml` and replace
+#      headplane_oidc_client_secret with the app's client secret.
+#   3. `headscale apikeys create` on the box, and replace
+#      headplane_headscale_api_key the same way.
+{
+  services.headplane = {
+    enable = true;
+    settings.server = {
+      cookie_secret_path = config.sops.secrets.headplane_cookie_secret.path;
+      cookie_secure = true;   # served over HTTPS via Caddy
+      base_url = "https://vpn.mgaction.town";
+    };
+
+    settings.oidc = {
+      issuer = "https://auth.mgaction.town";
+      client_id = "REPLACE_ME_zitadel_client_id"; # not secret, but not known until the app exists in Zitadel
+      client_secret_path = config.sops.secrets.headplane_oidc_client_secret.path;
+      headscale_api_key_path = config.sops.secrets.headplane_headscale_api_key.path;
+    };
+  };
+}
@@ -0,0 +1,25 @@
+{ ... }:
+
+# Headscale — self-hosted control server for the tailnet. Every host's
+# services/vpn/tailscale.nix points --login-server at https://vpn.mgaction.town
+# (this host). MagicDNS base_domain "hosts.mgaction.town" matches the
+# "jupiter.hosts.mgaction.town" names used in this repo's Caddy vhosts
+# (e.g. hosts/neptun/configuration.nix) — don't change one without the other.
+#
+# TLS terminates at Caddy (see the host's configuration.nix); headscale
+# itself only listens on localhost.
+{
+  services.headscale = {
+    enable = true;
+    port = 8082;   # zitadel already sits on the usual 8080 on this host
+
+    settings = {
+      server_url = "https://vpn.mgaction.town";
+
+      dns = {
+        base_domain = "hosts.mgaction.town";
+        nameservers.global = [ "1.1.1.1" "9.9.9.9" ];
+      };
+    };
+  };
+}
@@ -0,0 +1,16 @@
+{ config, ... }:
+
+# Tailscale node joined to the self-hosted headscale control server.
+# Auto-registers on boot from a sops pre-auth key. Requires the importing host
+# to declare `sops.secrets.tailscale_authkey` (see each host's secrets.nix).
+# Not for the VM (no sops).
+{
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;                       # UDP 41641 for direct connections
+    authKeyFile = config.sops.secrets.tailscale_authkey.path;
+    extraUpFlags = [ "--login-server=https://vpn.mgaction.town" ];
+  };
+  # Reach the host's services over the tailnet without opening LAN ports.
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
+}