darmanandClaude Sonnet 5
d7a66f3e3b
Group service modules by category (media, network, vpn, identity, dev, desktop) to make the growing services/ dir easier to navigate. containers.nix stays at the top level since it's a shared backend, not a single-category service. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
17 lines
669 B
Nix
17 lines
669 B
Nix
{ config, ... }:
|
|
|
|
# Tailscale node joined to the self-hosted headscale control server.
|
|
# Auto-registers on boot from a sops pre-auth key. Requires the importing host
|
|
# to declare `sops.secrets.tailscale_authkey` (see each host's secrets.nix).
|
|
# Not for the VM (no sops).
|
|
{
|
|
services.tailscale = {
|
|
enable = true;
|
|
openFirewall = true; # UDP 41641 for direct connections
|
|
authKeyFile = config.sops.secrets.tailscale_authkey.path;
|
|
extraUpFlags = [ "--login-server=https://vpn.mgaction.town" ];
|
|
};
|
|
# Reach the host's services over the tailnet without opening LAN ports.
|
|
networking.firewall.trustedInterfaces = [ "tailscale0" ];
|
|
}
|