headscale works

flake.lock

@@ -9,11 +9,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1785518313,
+        "lastModified": 1781627888,
-        "narHash": "sha256-anlq3YQDCsNrkNlu3HTg4dEIpRugwnyAVUxoPcBmA/U=",
+        "narHash": "sha256-5yHuAh9k7rT7rtf3uRaXkiUyYvQE9oaCgzhprLm2mr8=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "b974715a27b49fadbf3bf6d85e26bcb3109daa6d",
+        "rev": "6d3087eedff75a715b40c0e124ba15d2dd7bec28",
         "type": "github"
       },
       "original": {
@@ -79,11 +79,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785119570,
+        "lastModified": 1783740085,
-        "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
+        "narHash": "sha256-qajyHfZY29G2oEQk+uHxmsJcRoBUBXP9maTpFlwP/dI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
+        "rev": "3cd22efe6471dc7365c822bd9ad73a21e55f38fb",
         "type": "github"
       },
       "original": {
@@ -111,11 +111,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1785599192,
+        "lastModified": 1783703440,
-        "narHash": "sha256-dg4RTtDxnXY13UkJNdhmgTUTl0n/IJBlCigfO7nutZw=",
+        "narHash": "sha256-O3/YajjWo001VUIgD8BwaRdSNLUFe7nZ1qV5TwhRBcw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6d65bfc1bcef2ef39a239d38e577e92a89fb0f07",
+        "rev": "8f0500b9660505dc3cb647775fe9a978a74b5283",
         "type": "github"
       },
       "original": {
@@ -125,22 +125,6 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1782175435,
-        "narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "deploy-rs": "deploy-rs",
@@ -153,7 +137,9 @@
     },
     "sops-nix": {
       "inputs": {
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
         "lastModified": 1783174389,
@@ -164,8 +150,9 @@
         "type": "github"
       },
       "original": {
-        "id": "sops-nix",
+        "owner": "Mic92",
-        "type": "indirect"
+        "repo": "sops-nix",
+        "type": "github"
       }
     },
     "systems": {

flake.nix

@@ -8,6 +8,9 @@
     home-manager.url = "github:nix-community/home-manager/release-26.05";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
+    sops-nix.url = "github:Mic92/sops-nix";
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
+
     grasswren.url = "git+https://code.grasswren.net/Lilac/Grasswren.git?ref=main";
     grasswren.flake = false;
   };
@@ -20,6 +23,8 @@
         specialArgs = { inherit inputs; };
         modules = [
           home-manager.nixosModules.home-manager
+          sops-nix.nixosModules.sops
+
           ./hosts/desktop/default.nix
         ];
       };
@@ -28,18 +33,9 @@
         system = "x86_64-linux";
         specialArgs = { inherit inputs; };
         modules = [
-          home-manager.nixosModules.home-manager
           ./hosts/vps/default.nix
         ];
       };
-       backup = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        specialArgs = { inherit inputs; };
-        modules = [
-          home-manager.nixosModules.home-manager
-          ./hosts/backup/default.nix
-        ];
-      };
     };
 
     homeConfigurations.lilac = home-manager.lib.homeManagerConfiguration {
@@ -53,7 +49,7 @@
     # nix run github:serokell/deploy-rs
     deploy.nodes = {
       vps = {
-        hostname = "10.0.0.3";
+        hostname = "vps.vpn";
         sshUser = "root";
         magicRollbackTimeout = 120;
         profiles.system = {
@@ -64,7 +60,7 @@
       };
 
       desktop = {
-        hostname = "10.0.0.2";
+        hostname = "desktop.vpn";
         sshUser = "root";
         magicRollbackTimeout = 120;
         profiles.system = {
@@ -72,16 +68,6 @@
           remoteBuild = false;
           path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.desktop;
         };
-      };
-       backup = {
-        hostname = "10.0.0.4";
-        sshUser = "root";
-        magicRollbackTimeout = 120;
-        profiles.system = {
-          user = "root";
-          remoteBuild = false;
-          path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.backup;
-        };
       };
     };
     checks = {

hosts/backup/default.nix

@@ -1,109 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  imports = [ ./hardware-configuration.nix ../../modules/ssh.nix ];
-
-  networking.hostName = "backup";
-
-  users.users.lilac = {
-    isNormalUser = true;
-	group = "lilac";
-	extraGroups = [ "wheel" ];
-  };
-  users.groups.lilac = {};
-  home-manager = {
-    useGlobalPkgs = true;
-	useUserPackages = true;
-
-	users.lilac = import ../../home/lilac.nix;
-	};
-  programs.zsh.enable = true;
-  users.users.lilac.shell = pkgs.zsh;
-  security.sudo.wheelNeedsPassword = false;
-
-  time.timeZone = "America/Winnipeg";
-
-  systemd.sleep.settings.Sleep = {
-    AllowSuspend = "no";
-    AllowHibernation = "no";
-    AllowHybridSleep = "no";
-    AllowSuspendThenHibernate = "no";
-  };
-
-  i18n.defaultLocale = "en_US.UTF-8";
-  i18n.extraLocaleSettings = {
-    LC_ADDRESS = "en_US.UTF-8";
-    LC_IDENTIFICATION = "en_US.UTF-8";
-    LC_MEASUREMENT = "en_US.UTF-8";
-    LC_MONETARY = "en_US.UTF-8";
-    LC_NAME = "en_US.UTF-8";
-    LC_NUMERIC = "en_US.UTF-8";
-    LC_PAPER = "en_US.UTF-8";
-    LC_TELEPHONE = "en_US.UTF-8";
-    LC_TIME = "en_US.UTF-8";
-  };
-
-  services.xserver.enable = true;
-  services.displayManager.sddm.enable = true;
-  services.desktopManager.plasma6.enable = true;
-  services.xserver.xkb = {
-    layout = "us";
-    variant = "";
-  };
-
-  services.pulseaudio.enable = false;
-  security.rtkit.enable = true;
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    alsa.support32Bit = true;
-    pulse.enable = true;
-  };
-
-  environment.systemPackages = with pkgs; [
-    whipper
-	flac
-	tor-browser
-  ];
-
-  networking.wireless.enable = true;
-  networking.networkmanager.enable = true;
-
-  services.timesyncd.enable = true;    # optional
-
-networking = {
-    firewall = {
-	  enable = true;
-	  allowedUDPPorts = [ 51820 ];
-	  trustedInterfaces = [ "wg0" ];
-	};
-
-	wireguard.interfaces."wg0" = {
-      ips = [ "10.0.0.4/24" ];
-	  generatePrivateKeyFile = true;
-	  privateKeyFile = "/var/lib/wireguard/wg0.key";
-	  peers = [{
-        publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
-		allowedIPs = [ "10.0.0.0/24" ];
-		endpoint = "216.128.177.13:51820";
-		persistentKeepalive = 25;
-	  }];
-	};
-  };
-
-  nixpkgs.config.allowUnfree = true;
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
-  system.stateVersion = "26.05";
-
-
-
-  services.restic.server = {
-    enable = true;
-	listenAddress = "10.0.0.4:8000";
-	dataDir = "/var/lib/restic";
-	appendOnly = true;
-	extraFlags = [ "--no-auth" ];
-  };
-
-  networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8000 ];
-}

hosts/backup/hardware-configuration.nix

@@ -1,32 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usb_storage" "sd_mod" "sdhci_pci" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/61b493e0-8c91-b7d1-4e336da06ff0";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/E157-E223";
-      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
-    };
-
-  swapDevices = [ ];
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/desktop/default.nix

@@ -4,16 +4,19 @@
   imports = [
     ./hardware-configuration.nix
 
-    ../../modules/site/blog.nix
+	../../modules/network.nix
-    ../../modules/site/code.nix
-    ../../modules/site/mail.nix
-    ../../modules/site/music.nix
-    ../../modules/site/photo.nix
-	../../modules/site/vault.nix
-
 	../../modules/ssh.nix
+	../../modules/wireguard.nix
+	../../modules/headscale.nix
+	../../modules/tailscale.nix
+
+	../../modules/site.nix
+	../../modules/gitea.nix
+	../../modules/navidrome.nix
+	../../modules/immich.nix
   ];
 
+  network.node = "desktop";
   networking.hostName = "desktop";
 
   users.users.lilac = {
@@ -103,42 +106,9 @@
   environment.systemPackages = with pkgs; [
     whipper
 	flac
-	tor-browser
-	restic
   ];
 
-  programs.steam.enable = true;
-
-  networking = {
-    firewall = {
-	  enable = true;
-	  allowedUDPPorts = [ 51820 ];
-	  trustedInterfaces = [ "wg0" ];
-	};
-
-	wireguard.interfaces."wg0" = {
-      ips = [ "10.0.0.2/24" ];
-	  generatePrivateKeyFile = true;
-	  privateKeyFile = "/var/lib/wireguard/wg0.key";
-	  peers = [{
-        publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
-		allowedIPs = [ "10.0.0.0/24" ];
-		endpoint = "216.128.177.13:51820";
-		persistentKeepalive = 25;
-	  }];
-	};
-  };
-
   nixpkgs.config.allowUnfree = true;
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   system.stateVersion = "26.05";
-
-  services.restic.backups.backup = {
-    repository = "rest:http://10.0.0.4:8000/backup";
-	initialize = true;
-	passwordFile = "/home/lilac/test-password";
-	paths = [ "/var/lib/immich" "/var/lib/music" "/var/lib/gitea" "/var/lib/vault-backup" ];
-	timerConfig.OnCalendar = "03:30";
-	pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ];
-  };
 }

hosts/vps/default.nix

@@ -4,75 +4,17 @@
   imports = [
     ./hardware-configuration.nix
 
+    ../../modules/network.nix
     ../../modules/ssh.nix
+    ../../modules/wireguard.nix
+	../../modules/tailscale.nix
+
+    ../../modules/http-forwarding.nix
   ];
 
+  network.node = "vps";
   networking.hostName = "vps";
 
-  users.users.lilac = {
-    isNormalUser = true;
-	group = "lilac";
-	extraGroups = [ "wheel" ];
-  };
-  users.groups.lilac = {};
-  home-manager = {
-    useGlobalPkgs = true;
-    useUserPackages = true;
-    users.lilac = import ../../home/lilac.nix;
-  };
-  programs.zsh.enable = true;
-  users.users.lilac.shell = pkgs.zsh;
-  security.sudo.wheelNeedsPassword = false;
-
-  # forwarding inbound network traffic over wireguard
-  networking = {
-    firewall = {
-	  enable = true;
-	  allowedTCPPorts = [ 80 443 ];
-	  allowedUDPPorts = [ 51820 ];
-	  trustedInterfaces = [ "wg0" ];
-	};
-	wireguard.interfaces."wg0" = {
-      ips = [ "10.0.0.3/24" ];
-	  listenPort = 51820;
-	  generatePrivateKeyFile = true;
-	  privateKeyFile = "/var/lib/wireguard/wg0.key";
-	  peers = [
-	    {
-		  allowedIPs = [ "10.0.0.1/32" ];
-          publicKey = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU=";
-		}
-		{
-          allowedIPs = [ "10.0.0.2/32" ];
-		  publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
-		}
-		{
-		  allowedIPs = [ "10.0.0.4/32" ];
-		  publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
-		}
-      ];
-	};
-	nftables = {
-	  enable = true;
-	  tables.nat = {
-	    family = "ip";
-		content = ''
-          chain prerouting {
-            type nat hook prerouting priority dstnat; policy accept;
-            iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
-          }
-	      chain postrouting {
-            type nat hook postrouting priority srcnat; policy accept;
-            oifname "wg0" masquerade
-          }
-        '';
-      };
-	};
-  };
-  boot.kernel.sysctl = {
-    "net.ipv4.ip_forward" = 1;
-  };
-
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   system.stateVersion = "26.05";
 }

hosts/vps/hardware-configuration.nix

@@ -7,11 +7,11 @@
 	extraModulePackages = [ ];
   	loader.systemd-boot.enable = true;
   	loader.efi.canTouchEfiVariables = true;
-  	loader.efi.efiSysMountPoint = "/boot/efi";
+  	loader.efi.efiSysMountPoint = "/boot";
   };
 
   fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; };
-  fileSystems."/boot/efi" = { device = "/dev/vda1"; fsType = "vfat"; };
+  fileSystems."/boot" = { device = "/dev/vda1"; fsType = "vfat"; };
   swapDevices = [ ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

modules/gitea.nix

@@ -19,8 +19,6 @@
       name = "gitea";
       user = "gitea";
     };
-
-	settings.service.DISABLE_REGISTRATION = true;
   };
 
   services.caddy = {

modules/headscale.nix

@@ -1,11 +1,17 @@
 { config, lib, pkgs, ... }:
 
 {
+systemd.services.headscale.environment = {
+  GODEBUG = "netdns=go";
+};
+networking.enableIPv6 = false;
+  environment.etc."headscale/derp.yaml".source = ./derp.yaml;
   services.headscale = {
+
     enable = true;
 	settings = {
       server_url = "https://vpn.grasswren.net";
-	  listen_addr = "127.0.0.1:8080";
+	  listen_addr = "0.0.0.0:8080";
 
 	  database.type = "sqlite";
 
@@ -15,8 +21,8 @@
       ];
 
 	  dns = {
-	    magic_domain = true;
+	    magic_dns = true;
-	    base_domain = "vpn.grasswren.net";
+	    base_domain = "vpn";
 		nameservers.global = [ "1.1.1.1" ];
 	  };
 	};

modules/http-forwarding.nix

@@ -0,0 +1,28 @@
+{ config, lib, pkgs, ... }:
+
+{
+  networking.firewall.enable = true;
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  networking.nftables.enable = true;
+  networking.nftables.tables.nat = {
+    family = "ip";
+    content = ''
+      chain prerouting {
+        type nat hook prerouting priority dstnat; policy accept;
+
+        iifname "enp1s0" tcp dport 80 dnat to 10.0.0.2:80
+        iifname "enp1s0" tcp dport 443 dnat to 10.0.0.2:443
+      }
+	    chain postrouting {
+        type nat hook postrouting priority srcnat; policy accept;
+
+        oifname "wg0" masquerade
+      }
+    '';
+  };
+
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+  };
+}

modules/immich.nix

@@ -10,7 +10,7 @@
 
   services.caddy = {
     enable = true;
-	virtualHosts."photo.grasswren.net".extraConfig = ''
+	virtualHosts."image.grasswren.net".extraConfig = ''
       reverse_proxy localhost:2283
 	'';
   };

modules/network.nix

@@ -0,0 +1,41 @@
+{ config, lib, pkgs, ... }:
+
+{
+  options.network = {
+    nodes = lib.mkOption { type = lib.types.attrsOf
+	  (lib.types.submodule ({ name, config, ... }: {
+        options = {
+          id          = lib.mkOption { type = lib.types.int; };
+          ssh         = lib.mkOption { type = lib.types.str; };
+          vpn         = lib.mkOption { type = lib.types.str; };
+		  address-vpn = lib.mkOption { type = lib.types.str; };
+          address-pub = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; };
+		};
+		config = {
+          address-vpn = "10.0.0.${toString config.id}";
+		};
+	  }));
+	};
+	node = lib.mkOption { type = lib.types.str; };
+  };
+  config.network = {
+    nodes = {
+      laptop = {
+        id = 1;
+        ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg";
+        vpn = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU=";
+      };
+      desktop = {
+        id = 2;
+        ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdOUv+mUhnS2sbahlqcqm9Ili16/rOk2WAlMSXrjnHu";
+        vpn = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
+      };
+      vps = {
+        id = 3;
+        ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGiiLFiy+UcOi0RgZ1Xvuzl4C5aiZ+bcGaOmQcI/UBXp";
+        vpn = "c5irm217aE+QVwHYmnQh4r91u2fZmQKBIWVgFVMaEwU=";
+        address-pub = "216.128.177.13";
+      };
+    };
+  };
+}

modules/site.nix

@@ -23,5 +23,11 @@ in
       root * ${website}/blog
       file_server
     '';
+
+    virtualHosts."birds.grasswren.net".extraConfig = ''
+      encode
+      root * ${website}/birds
+      file_server
+    '';
   };
 }

modules/site/vault.nix

@@ -1,21 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  services.vaultwarden = {
-    enable = true;
-	backupDir = "/var/lib/vault-backup";
-    config = {
-      DOMAIN = "https://vault.example.com";
-      SIGNUPS_ALLOWED = false;
-      ROCKET_ADDRESS = "127.0.0.1";
-      ROCKET_PORT = 8222;
-    };
-  };
-
-  services.caddy = {
-    enable = true;
-	virtualHosts."vault.grasswren.net".extraConfig = ''
-	  reverse_proxy localhost:8222
-	'';
-  };
-}

modules/ssh.nix

@@ -1,9 +1,12 @@
 { config, lib, pkgs, ... }:
 
+let
+  me = config.network.nodes.${config.network.node};
+in
 {
   networking.firewall = {
     enable = true;
-	interfaces.wg0.allowedTCPPorts = [ 22 ];
+	allowedTCPPorts = [ 22 ];
   };
   services.openssh = {
     enable = true;
@@ -18,11 +21,14 @@
 	}];
   };
 
-  users.users.lilac.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg"
-  ];
-
   users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg"
+    config.network.nodes.laptop.ssh
+	config.network.nodes.desktop.ssh
   ];
+  users.users.lilac = lib.mkIf (config.network.node != "vps") {
+    openssh.authorizedKeys.keys = [
+      config.network.nodes.laptop.ssh
+      config.network.nodes.desktop.ssh
+    ];
+  };
 }

modules/tailscale.nix

@@ -0,0 +1,5 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.tailscale.enable = true;
+}

modules/wireguard.nix

@@ -0,0 +1,38 @@
+{ config, lib, pkgs, ... }:
+
+let
+  me = config.network.nodes.${config.network.node};
+in
+{
+  networking = {
+    firewall = {
+      allowedUDPPorts = [ 51820 ];
+	    trustedInterfaces = [ "wg0" ];
+	  };
+	  wireguard.interfaces."wg0" = {
+      ips = [ "${me.address-vpn}/24" ];
+	    listenPort = 51820;
+	    generatePrivateKeyFile = true;
+	    privateKeyFile = "/var/lib/wireguard/wg0.key";
+	    peers = lib.mapAttrsToList (name: peer: {
+        publicKey = peer.vpn;
+		    allowedIPs =
+		      if config.network.node == "vps"
+			      then [ "${peer.address-vpn}/32" ]
+			      else [ "10.0.0.0/24" ];
+		    endpoint =
+		      if peer.address-pub != null
+			      then "${peer.address-pub}:51820"
+			      else null;
+		    persistentKeepalive =
+		      if peer.address-pub != null
+			      then 25
+			      else null;
+	    }) (lib.filterAttrs (name: _:
+        if config.network.node == "vps"
+		      then name != "vps"
+          else name == "vps"
+      ) config.network.nodes);
+	  };
+  };
+}