felschr/nixos-config
1
1
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

feat(vpn): improve tailscale config

Browse source
This commit is contained in:
Felix Schröter 2023-12-27 18:03:57 +01:00
parent bdbb43b09d
commit 6ca1656297
Signed by: felschr
GPG key ID: 671E39E6744C807D
3 changed files with 19 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
hosts/home-pc.nix
View file

@ -40,6 +40,8 @@
}; };
}; };
services.tailscale.extraUpFlags = [ "--advertise-routes=192.168.1.0/24" ];
networking.firewall.allowedUDPPorts = [ networking.firewall.allowedUDPPorts = [
24727 # AusweisApp2 24727 # AusweisApp2
]; ];

6
hosts/home-server.nix
View file

@ -113,6 +113,12 @@ in {
inherit hostKeys; inherit hostKeys;
}; };
services.tailscale.extraUpFlags = [
"--advertise-routes=192.168.1.0/24"
"--advertise-tags=tag:felschr-com"
"--advertise-connector"
];
# ssh root@hostname "echo "$(read -s pass; echo \'"$pass"\')" > /crypt-ramfs/passphrase" # ssh root@hostname "echo "$(read -s pass; echo \'"$pass"\')" > /crypt-ramfs/passphrase"
boot.initrd.availableKernelModules = [ "igb" ]; boot.initrd.availableKernelModules = [ "igb" ];
boot.initrd.network = { boot.initrd.network = {

16
system/vpn.nix
View file

@ -1,15 +1,21 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ let tailscaleInterface = config.services.tailscale.interfaceName;
in {
age.secrets.mullvad.file = ../secrets/mullvad.age; age.secrets.mullvad.file = ../secrets/mullvad.age;
networking.wireguard.enable = true; networking.wireguard.enable = true;
networking.firewall.trustedInterfaces = [ tailscaleInterface ];
services.tailscale = {
enable = true;
# authKeyFile = ; # TODO add this to create auto-connect systemd job
openFirewall = true;
useRoutingFeatures = "both";
};
services.tailscale.enable = true;
services.mullvad-vpn.enable = true; services.mullvad-vpn.enable = true;
networking.firewall.trustedInterfaces = [ "tailscale0" ];
# set some options after every daemon start # set some options after every daemon start
# to avoid accidentally leaving unsafe settings # to avoid accidentally leaving unsafe settings
systemd.services."mullvad-daemon" = { systemd.services."mullvad-daemon" = {
@ -52,7 +58,7 @@
} }
chain allow-incoming { chain allow-incoming {
type filter hook input priority -100; policy accept; type filter hook input priority -100; policy accept;
iifname "tailscale0" ct mark set 0x00000f41 meta mark set 0x6d6f6c65; iifname "${tailscaleInterface}" ct mark set 0x00000f41 meta mark set 0x6d6f6c65;
} }
} }
'' ''