darmanandClaude Sonnet 5
6f24ab69ad
Comments had drifted into multi-paragraph narrative (git commit lineage, debugging stories, restated code) in several hot spots (scripts/deploy, hermes-agent.nix, flake.nix, gitea.nix, headscale.nix). Trim every comment to its load-bearing "why" — gotchas, safety warnings, and non-obvious rationale survive verbatim in substance, just tightened to 1-2 sentences; historical narrative and anything already covered in CLAUDE.md is cut. No code/logic changed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UJqEmY1y3AYX3JoX4Y6b21
27 lines
1.1 KiB
Nix
27 lines
1.1 KiB
Nix
{ config, ... }:
|
|
|
|
# Tailscale node joined to the self-hosted headscale control server,
|
|
# auto-registering on boot from a sops pre-auth key — importing hosts must
|
|
# declare `sops.secrets.tailscale_authkey` (see each host's secrets.nix).
|
|
# Not used by the VM target (no sops there).
|
|
{
|
|
services.tailscale = {
|
|
enable = true;
|
|
openFirewall = true; # UDP 41641 for direct connections
|
|
authKeyFile = config.sops.secrets.tailscale_authkey.path;
|
|
extraUpFlags = [ "--login-server=https://vpn.mgaction.town" ];
|
|
};
|
|
# Reach the host's services over the tailnet without opening LAN ports.
|
|
networking.firewall.trustedInterfaces = [ "tailscale0" ];
|
|
|
|
# The upstream unit is a one-shot with no Restart, so a login attempted
|
|
# before the control server is up fails permanently until restarted by
|
|
# hand — the norm on first boot, since neptun hosts headscale itself and
|
|
# other hosts race it. 30s spacing keeps retries clear of systemd's default
|
|
# start limit (5 within 10s).
|
|
systemd.services.tailscaled-autoconnect.serviceConfig = {
|
|
Restart = "on-failure";
|
|
RestartSec = 30;
|
|
};
|
|
}
|