all repos — nixfiles @ 9ceb482b714b5a2d39f0898323ffc33ea2eae1ca

System and user configuration, managed by nix and home-manager

system/roles/headscale.nix (view raw)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
{
  config,
  ...
}:
let
  subdomain = "hs.alin.ovh";
  issuer = "https://id.alin.ovh";
  inherit (config.services) headscale headplane;
in
{
  age.secrets = {
    headscale-oidc = {
      file = ../../secrets/headscale-oidc.age;
      owner = headscale.user;
      group = headscale.group;
    };
    headplane-cookie = {
      file = ../../secrets/headplane-cookie.age;
      owner = headscale.user;
      group = headscale.group;
    };
    headplane-headscale-api = {
      file = ../../secrets/headplane-headscale-api.age;
      owner = headscale.user;
      group = headscale.group;
    };
    headplane-oidc = {
      file = ../../secrets/headplane-oidc.age;
      owner = headscale.user;
      group = headscale.group;
    };
  };

  services.headscale = {
    enable = true;
    port = 18443;
    settings = {
      # acme_url = config.security.acme.defaults.server;
      # tls_letsencrypt_hostname = domain;
      # tls_letsencrypt_listen = ":18080";
      server_url = "https://${subdomain}";
      tls_cert_path = null;
      tls_key_path = null;
      trusted_proxies = [
        "127.0.0.1/32"
        "::1/128"
      ];
      oidc = {
        issuer = issuer;
        client_id = "e1658483-71ee-4260-9862-a92b9fdadece";
        client_secret_path = config.age.secrets.headscale-oidc.path;
        pkce = {
          enabled = true;
          method = "S256";
        };
      };
      prefixes.allocation = "random";
      node.expiry = "180d";
      dns = {
        magic_dns = false;
        override_local_dns = false;
      };
    };
  };

  services.headplane = {
    enable = true;
    settings = {
      headscale = {
        url = headscale.settings.server_url;
      };
      server = {
        base_url = headscale.settings.server_url;
        cookie_secret_path = config.age.secrets.headplane-cookie.path;
      };
      oidc = {
        headscale_api_key_path = config.age.secrets.headplane-headscale-api.path;
        client_id = "d7e09578-158a-4954-ba86-d3e9177c1a15";
        client_secret_path = config.age.secrets.headplane-oidc.path;
        issuer = issuer;
      };
    };
  };

  services.caddy.virtualHosts = {
    ${subdomain} = {
      extraConfig = ''
        reverse_proxy /admin/* localhost:${toString headplane.settings.server.port}

        reverse_proxy localhost:${toString headscale.port}
      '';
    };
  };
}