34 lines
743 B
Nix
34 lines
743 B
Nix
{
|
|
config,
|
|
inputs,
|
|
...
|
|
}:
|
|
{
|
|
networking.firewall.trustedInterfaces = [ "tailscale0" ];
|
|
|
|
services.tailscale = {
|
|
enable = true;
|
|
openFirewall = true;
|
|
authKeyFile = config.sops.secrets.tailscale_auth_key.path;
|
|
|
|
# OAuth client secrets create ephemeral nodes by default. NixOS machines
|
|
# are persistent and should enroll without interactive device approval.
|
|
authKeyParameters = {
|
|
ephemeral = false;
|
|
preauthorized = true;
|
|
};
|
|
|
|
extraUpFlags = [ "--advertise-tags=tag:nixos" ];
|
|
};
|
|
|
|
sops = {
|
|
age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
|
|
|
secrets.tailscale_auth_key = {
|
|
sopsFile = "${inputs.self}/users/secrets.yaml";
|
|
owner = "root";
|
|
mode = "0400";
|
|
};
|
|
};
|
|
}
|