tree 25cfb21696ed8178d31015fcd8607d35d2c67efb
parent 04ff717979a8b37b0af0574295e234684f86f404
author Skyler Grey <minion@clicks.codes> 1718146080 +0000
committer Samuel Shuert <coded@clicks.codes> 1718146681 +0000

fix(teal.headscale): Allow access to the internet

Previously internet access was denied by ACLs, so even if you did set up
an exit node no traffic would flow.

In Tailscale there's a thing called "autogroup:internet", which is a
list of all the IP addresses in the internet. That's awesome, but sadly
it's not yet supported in headscale (it's in the upcoming release)

We can define our own internet. We can't use builtin groups (because
they're IPs not users) and we can't use builtin hosts (because there's
no way I could find to specify multiple prefixes for a host), however
Nix comes to our rescue and gives us the ability to define a list and
map over it.

There's one more cursed hack: the IPv6 address space uses colons (::) to
denote separators. Unfortunately, including the address as-is leaves us
with a mixup where headscale interprets part of the address as a port,
considers the ACLs broken and refuses to start. Luckily, as there's only
one affected address we can pretty easily define a host for it, which
solves the issue as the parsing happens earlier... yay..?

Change-Id: Id4d51cd6b358a6cd150d7221087564882efd4e2c
Reviewed-on: https://git.clicks.codes/c/Infra/NixFiles/+/754
Tested-by: Skyler Grey <minion@clicks.codes>
Reviewed-by: Samuel Shuert <coded@clicks.codes>