nix

commit 46d019f594cfb9b68e6dfe1b017ddded058e2a26
parent 1254511ed8947ff34b493b1733d7a4315517e05b
Author: mtmn <miro@haravara.org>
Date:   Wed, 17 Jun 2026 01:39:16 +0200

headscale: add derp to module

Diffstat:
M
hosts/nixaran/configuration.nix
 | 
0

M
modules/services/headscale.nix
 | 
29
+++++++++++++++++++++++++++++

2 files changed, 29 insertions(+), 0 deletions(-)
diff --git a/hosts/nixaran/configuration.nix b/hosts/nixaran/configuration.nix
Binary files differ.
diff --git a/modules/services/headscale.nix b/modules/services/headscale.nix
@@ -29,6 +29,24 @@ in {
       default = 8085;
       description = "The port for the Headscale instance";
     };
+    derp = {
+      enable = lib.mkEnableOption "embedded DERP relay server";
+      stunPort = lib.mkOption {
+        type = lib.types.port;
+        default = 3478;
+        description = "UDP port for the embedded DERP STUN service";
+      };
+      regionName = lib.mkOption {
+        type = lib.types.str;
+        default = "Headscale Embedded DERP";
+        description = "Display name for the embedded DERP region";
+      };
+      regionCode = lib.mkOption {
+        type = lib.types.str;
+        default = "headscale";
+        description = "Short slug for the embedded DERP region";
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -51,9 +69,20 @@ in {
           "100.64.0.0/10"
           "fd7a:115c:a1e0::/48"
         ];
+        derp.server = lib.mkIf cfg.derp.enable {
+          enabled = true;
+          region_id = 999;
+          region_code = cfg.derp.regionCode;
+          region_name = cfg.derp.regionName;
+          stun_listen_addr = "0.0.0.0:${toString cfg.derp.stunPort}";
+          private_key_path = "/var/lib/headscale/derp_server_private.key";
+          automatically_add_embedded_derp_region = true;
+        };
       };
     };
 
+    networking.firewall.allowedUDPPorts = lib.mkIf cfg.derp.enable [cfg.derp.stunPort];
+
     services.caddy.virtualHosts."${cfg.domain}" = {
       extraConfig = ''
         reverse_proxy ${cfg.address}:${toString cfg.port}