nix

configuration files that power my machines
Log | Files | Refs | README | LICENSE

headscale.nix (2937B)

      1 {
      2   config,
      3   lib,
      4   ...
      5 }: let
      6   cfg = config.services.haravara.headscale;
      7 in {
      8   options.services.haravara.headscale = {
      9     enable = lib.mkEnableOption "Headscale service";
     10     initUser = lib.mkOption {
     11       type = lib.types.str;
     12       description = "Username for the initial Headscale admin user";
     13     };
     14     domain = lib.mkOption {
     15       type = lib.types.str;
     16       description = "The domain for the Headscale instance";
     17     };
     18     magicDnsDomain = lib.mkOption {
     19       type = lib.types.str;
     20       description = "The domain for the Magic DNS feature";
     21     };
     22     address = lib.mkOption {
     23       type = lib.types.str;
     24       default = "127.0.0.1";
     25       description = "The address for Headscale to listen on";
     26     };
     27     port = lib.mkOption {
     28       type = lib.types.port;
     29       default = 8085;
     30       description = "The port for the Headscale instance";
     31     };
     32     extraDnsRecords = lib.mkOption {
     33       type = lib.types.listOf (lib.types.attrsOf lib.types.str);
     34       default = [];
     35       description = "Extra DNS records to push to all tailnet clients";
     36     };
     37     derp = {
     38       enable = lib.mkEnableOption "embedded DERP relay server";
     39       stunPort = lib.mkOption {
     40         type = lib.types.port;
     41         default = 3478;
     42         description = "UDP port for the embedded DERP STUN service";
     43       };
     44       regionName = lib.mkOption {
     45         type = lib.types.str;
     46         default = "Headscale Embedded DERP";
     47         description = "Display name for the embedded DERP region";
     48       };
     49       regionCode = lib.mkOption {
     50         type = lib.types.str;
     51         default = "headscale";
     52         description = "Short slug for the embedded DERP region";
     53       };
     54     };
     55   };
     56 
     57   config = lib.mkIf cfg.enable {
     58     services.headscale = {
     59       enable = true;
     60       inherit (cfg) address port;
     61       settings = {
     62         server_url = "https://${cfg.domain}";
     63         grpc_listen_addr = "127.0.0.1:50443";
     64         grpc_allow_insecure = true;
     65         dns = {
     66           magic_dns = true;
     67           base_domain = "${cfg.magicDnsDomain}";
     68           nameservers.global = [
     69             "1.1.1.1"
     70             "8.8.8.8"
     71           ];
     72           extra_records = cfg.extraDnsRecords;
     73         };
     74         ip_prefixes = [
     75           "100.64.0.0/10"
     76           "fd7a:115c:a1e0::/48"
     77         ];
     78         derp.server = lib.mkIf cfg.derp.enable {
     79           enabled = true;
     80           region_id = 999;
     81           region_code = cfg.derp.regionCode;
     82           region_name = cfg.derp.regionName;
     83           stun_listen_addr = "0.0.0.0:${toString cfg.derp.stunPort}";
     84           private_key_path = "/var/lib/headscale/derp_server_private.key";
     85           automatically_add_embedded_derp_region = true;
     86         };
     87       };
     88     };
     89 
     90     networking.firewall.allowedUDPPorts = lib.mkIf cfg.derp.enable [cfg.derp.stunPort];
     91 
     92     services.caddy.virtualHosts."${cfg.domain}" = {
     93       extraConfig = ''
     94         reverse_proxy ${cfg.address}:${toString cfg.port}
     95       '';
     96     };
     97   };
     98 }