test out tailscale

modules/misc/cli-tools.nix

@@ -103,6 +103,7 @@ in {
         iotop
         inetutils
         nettools
+        wireguard-tools
       ];
     };
 }

systems/adam-site/configuration.nix

@@ -137,14 +137,14 @@
   networking.wg-quick.interfaces = {
     wg0 = {
       autostart = true;
-      address = [ "10.100.0.1/24" "fd42:4242:4242::1/64" ];
+      address = [ "10.100.0.1/24" "fd42:42:42::1/64" ];
       listenPort = 51820;
       privateKeyFile = config.age.secrets.wireguard.path;
       peers = [
         {
           # kop pc
           publicKey = "YgecbWSNRqOmylYqxr/V21LL3UpKEr5x42lXPAxriSc=";
-          allowedIPs = [ "10.100.0.2/32" "fd42:4242:4242::2/128" ];
+          allowedIPs = [ "10.100.0.2/32" "fd42:42:42::2/128" ];
         }
       ];
     };

systems/amd-server-vpn-vm/configuration.nix

@@ -64,6 +64,24 @@
     };
   };
 
+  # https://github.com/juanfont/headscale/blob/main/config-example.yaml
+  #networking.firewall.allowedTCPPorts = [ 8080 ];
+  #services.headscale = {
+  #  enable = true;
+  #  address = "0.0.0.0";
+  #  settings = {
+  #    server_url = "http://0.0.0.0:8080";
+  #    logtail.enable = false;
+  #    dns = { 
+  #      base_domain = "kopatz.dev"; 
+  #      override_local_dns = false;
+  #    };
+  #  };
+  #};
+  #environment.systemPackages = with pkgs; [
+  #  headscale
+  #];
+
   #fileSystems."/" = {
   #  device = "/dev/disk/by-label/nixos";
   #  fsType = "ext4";

systems/pc/configuration.nix

@@ -19,6 +19,7 @@
     ../../modules/misc/zram.nix
     #../../modules/hardware/ryzenmonitor.nix
     ../../modules/networkmanager.nix
+    #./tailscale-client.nix
   ];
 
   custom = {

systems/pc/tailscale-client.nix

@@ -0,0 +1,10 @@
+{pkgs, lib, config, ...}:
+{
+  # Run tailscale up --login-server http://<headscale_server>
+  services.tailscale.enable = true;
+  networking.firewall = {
+    checkReversePath = "loose";
+    trustedInterfaces = [ "tailscale0" ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
+  };
+}