all repos — nixfiles @ 67f7c6a4685cc0af25a76195c8e9d02ecc18dae1

System and user configuration, managed by nix and home-manager

system/roles/tailscale-subnet-router.nix (view raw)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
{
  config,
  lib,
  ...
}:
let
  lan = builtins.head config.networking.nat.internalInterfaces;
  withArg =
    arg: list:
    if list == [ ] || builtins.length list == 1 then
      list
    else
      lib.concatMap (x: [
        arg
        x
      ]) list;
in
{
  networking.firewall.extraForwardRules = ''
    iifname "tailscale0" oifname "${lan}" accept
    iifname "${lan}" oifname "tailscale0" accept
  '';

  services.tailscale.extraSetFlags =
    withArg "--advertise-routes"
      config.systemd.network.networks."40-${lan}".address;
}