commit c6f6303c7878e4e33c4112a4ce665177a6752faf
author Samuel Shuert <me@thecoded.prof> Tue Dec 31 11:09:23 2024 -0500
committer Skyler Grey <minion@clicks.codes> Wed Jan 22 10:31:07 2025 +0000
tree b8b28ba235b684df9c1bd5753a0889c4e7bc1c38
parent 57b0e77158effae1b04c466701175dafbd25dfb3

muliple(teal): Update teal

feat: Add a.starrysky.blog
feat: re-key keys with shorthairNanoResident age key
chore: update packages
fix: redo headscale options
Change-Id: I27cab9abc4622f0a69811e35d4e0eb87af29b42b
Reviewed-on: https://git.clicks.codes/c/Infra/NixFiles/+/981
Reviewed-by: Skyler Grey <minion@clicks.codes>
Tested-by: Skyler Grey <minion@clicks.codes>

modules/nixos/clicks/services/headscale/default.nix

diff --git a/modules/nixos/clicks/services/headscale/default.nix b/modules/nixos/clicks/services/headscale/default.nix
index 2d104bd..69c4c39 100644
--- a/modules/nixos/clicks/services/headscale/default.nix
+++ b/modules/nixos/clicks/services/headscale/default.nix
@@ -6,6 +6,8 @@
   lib,
   config,
   pkgs,
+  system,
+  inputs,
   ...
 }:
 let
@@ -18,6 +20,10 @@
       type = lib.types.str;
       description = "The domain of the url users should connect to to register a new device";
     };
+    server_url = lib.mkOption {
+      type = lib.types.str;
+      description = "The domain of the url users should connect to to register a new device";
+    };
     addr = lib.mkOption {
       type = lib.types.str;
       description = "Where to host headscale";
@@ -48,10 +54,6 @@
         description = "Client secret file path";
       };
     };
-    database_password_path = lib.mkOption {
-      type = lib.types.str;
-      description = "Database password file path";
-    };
     noise_private_key_path = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       description = "Noise private key file path";
@@ -71,16 +73,15 @@
 
   config = lib.mkIf cfg.enable {
     clicks = {
-      services.postgres.enable = true;
-      services.postgres.databases.headscale = cfg.database_password_path;
-      services.postgres.secretRequiredGroups = [ "headscale" ];
       services.nginx.enable = true;
-      services.nginx.hosts.${cfg.domain} = {
+      services.nginx.hosts.${cfg.server_url} = {
         service = lib.clicks.nginx.http.reverseProxy cfg.addr cfg.port;
         www = false;
         # TODO: disable http when we have changed a1d2's reverse proxy config to allow us to terminate HTTPS
         enableHttp = true;
       };
+
+      storage.impermanence.persist.directories = [ "/var/lib/headscale" ];
     };
 
     services.headscale = {
@@ -89,34 +90,27 @@
       address = cfg.addr;
       port = cfg.port;
 
-      settings.db_type = "postgres";
-      settings.db_port = config.services.postgresql.settings.port;
-      settings.db_user = "headscale";
-      settings.db_password_file = cfg.database_password_path;
-      settings.db_name = "headscale";
-      settings.db_host = lib.clicks.constants.hosts.standard;
+      package = lib.recursiveUpdate inputs.headscale.packages.${system}.headscale ({ meta.mainProgram = "headscale"; });
 
-      settings.server_url = "https://${cfg.domain}";
-
-      settings.ip_prefixes = "100.64.0.0/10";
+      settings.server_url = "https://${cfg.server_url}";
 
       settings.noise.private_key_path = lib.mkIf (
         cfg.noise_private_key_path != null
       ) cfg.noise_private_key_path;
-      settings.private_key_path = lib.mkIf (cfg.private_key_path != null) cfg.private_key_path;
 
-      settings.dns_config = {
-        nameservers = [
+      settings.dns = {
+        nameservers.global = [
           "1.1.1.1"
           "1.0.0.1"
+          "2606:4700:4700::1111"
+          "2606:4700:4700::1001"
         ];
-        domains = [ cfg.domain ];
-        override_local_dns = true;
         base_domain = cfg.domain;
       };
 
       settings.oidc = lib.mkIf cfg.oidc.enable {
         only_start_if_oidc_is_available = true;
+        strip_email_domain = true;
 
         issuer = cfg.oidc.issuer;
 
@@ -124,17 +118,12 @@
         client_secret_path = cfg.oidc.client_secret_path;
 
         allowed_groups = lib.mkIf (cfg.oidc.allowed_groups != null) cfg.oidc.allowed_groups;
-        strip_email_domain = true;
       };
 
-      settings.acl_policy_path = lib.mkIf (cfg.acl != null) (
-        pkgs.writers.writeJSON "tailscale-acls.json" cfg.acl
-      );
+      settings.policy = lib.mkIf (cfg.acl != null) {
+        mode = "file";
+        path = (pkgs.writers.writeJSON "tailscale-acls.json" cfg.acl);
+      };
     };
-
-    systemd.services.headscale.requires = [ "postgresql.service" ] ++
-                                          (if config.clicks.services.nginx.enable then [ "nginx.service" ] else []);
-    systemd.services.headscale.after = [ "postgresql.service" ] ++
-                                       (if config.clicks.services.nginx.enable then [ "nginx.service" ] else []);
   };
 }