OOKNET                             [ /  search the index  ]  
──────────────────────────────────────────────────────────────────────────────────────
[ KB ]    [ GIT ]    [ PROJECTS ]    [ ABOUT ]                                      EN
══════════════════════════════════════════════════════════════════════════════════════
OOKNET   [ /  search  ]  
────────────────────────────────────────────────
[ KB ] [ GIT ] [ PROJECTS ] [ ABOUT ]
════════════════════════════════════════════════
 
 
main @ 52 LINES
 
[ HISTORY ]  [ UP ]
 

{
  config,
  lib,
  ...
}: let
  inherit (lib) mkIf;
  inherit (lib.lists) concatLists optionals;
  inherit (config.ooknet) host;
  inherit (config.ooknet.host) admin;
  inherit (config.services) tailscale;
in {
  services.tailscale = {
    enable = true;

    # "client"/"both" - reverce path filtering will be set to loose instead of str
ict
    # "server"/"both" - ip forwarding will be enabled
    useRoutingFeatures = "both";

    # user that can fetch tailscale tls certs
    permitCertUid = "root";

    # authentication key for auto connect service
    authKeyFile = mkIf (host.role != "installer") config.age.secrets.tailscale-aut
h.path;

    # flags to pass to the auto-connect service
    extraUpFlags = concatLists [
      ["--ssh"]
      ["--operator" "${admin.name}"]
      (optionals host.exitNode ["--advertise-exit-node"])
    ];

    # opens relevant tailscale ports over UDP
    openFirewall = true;
  };

  # trust tailscale default interface
  networking.firewall.trustedInterfaces = ["${tailscale.interfaceName}"];

  # credit github:notashelf/nyx
  systemd = {
    # ignore tailscale interface for wait-online service
    network.wait-online.ignoredInterfaces = ["${tailscale.interfaceName}"];

    # only start tailscale daemon after network-online and systemd-resolved servic
es
    # are up
    services.tailscaled = {
      after = ["network-online.target" "systemd-resolved.service"];
      wants = ["network-online.target" "systemd-resolved.service"];
    };
  };
}


{
  config,
  lib,
  ...
}: let
  inherit (lib) mkIf;
  inherit (lib.lists) concatLists optionals;
  inherit (config.ooknet) host;
  inherit (config.ooknet.host) admin;
  inherit (config.services) tailscale;
in {
  services.tailscale = {
    enable = true;

    # "client"/"both" - reverce path filteri
ng will be set to loose instead of strict
    # "server"/"both" - ip forwarding will b
e enabled
    useRoutingFeatures = "both";

    # user that can fetch tailscale tls cert
s
    permitCertUid = "root";

    # authentication key for auto connect se
rvice
    authKeyFile = mkIf (host.role != "instal
ler") config.age.secrets.tailscale-auth.path
;

    # flags to pass to the auto-connect serv
ice
    extraUpFlags = concatLists [
      ["--ssh"]
      ["--operator" "${admin.name}"]
      (optionals host.exitNode ["--advertise
-exit-node"])
    ];

    # opens relevant tailscale ports over UD
P
    openFirewall = true;
  };

  # trust tailscale default interface
  networking.firewall.trustedInterfaces = ["
${tailscale.interfaceName}"];

  # credit github:notashelf/nyx
  systemd = {
    # ignore tailscale interface for wait-on
line service
    network.wait-online.ignoredInterfaces = 
["${tailscale.interfaceName}"];

    # only start tailscale daemon after netw
ork-online and systemd-resolved services
    # are up
    services.tailscaled = {
      after = ["network-online.target" "syst
emd-resolved.service"];
      wants = ["network-online.target" "syst
emd-resolved.service"];
    };
  };
}

 
──────────────────────────────────────────────────────────────────────────────────────
OOKNET
────────────────────────────────────────────────
OOKNET