feat(tailscale): add Tailscale service configuration and update secrets

2026-08-26 07:33:31 -04:00
parent a23c91c4ac
commit 03537310cb
3 changed files with 77 additions and 37 deletions
@@ -0,0 +1,33 @@
+{
+  config,
+  inputs,
+  ...
+}:
+{
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
+
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;
+    authKeyFile = config.sops.secrets.tailscale_auth_key.path;
+
+    # OAuth client secrets create ephemeral nodes by default. NixOS machines
+    # are persistent and should enroll without interactive device approval.
+    authKeyParameters = {
+      ephemeral = false;
+      preauthorized = true;
+    };
+
+    extraUpFlags = [ "--advertise-tags=tag:nixos" ];
+  };
+
+  sops = {
+    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+    secrets.tailscale_auth_key = {
+      sopsFile = "${inputs.self}/users/secrets.yaml";
+      owner = "root";
+      mode = "0400";
+    };
+  };
+}