felschr/nixos-config
1
1
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

fix(vpn): fix autoconnect service

Browse source
This commit is contained in:
Felix Schröter 2024-01-25 02:18:09 +01:00
parent 7bb4b02d52
commit e29a9da526
Signed by: felschr
GPG key ID: 671E39E6744C807D
1 changed files with 17 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
system/vpn.nix
View file

@ -11,7 +11,6 @@ in {
services.tailscale = {
enable = true;
authKeyFile = "/dummy";
openFirewall = true;
useRoutingFeatures = "both";
extraUpFlags = [
@ -26,18 +25,25 @@ in {
[ "TS_DEBUG_FIREWALL_MODE=auto" ];
# call taiscale up without --auth-key
systemd.services.tailscaled-autoconnect.script = ''
status=$(${config.systemd.package}/bin/systemctl show -P StatusText tailscaled.service)
if [[ $status != Connected* ]]; then
${cfg.package}/bin/tailscale up
fi
systemd.services.tailscaled-autoconnect = lib.mkIf (cfg.authKeyFile == null) {
after = [ "tailscaled.service" ];
wants = [ "tailscaled.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot";
script = ''
status=$(${config.systemd.package}/bin/systemctl show -P StatusText tailscaled.service)
if [[ $status != Connected* ]]; then
${cfg.package}/bin/tailscale up
fi
# some options cannot be set immediately
${cfg.package}/bin/tailscale up ${lib.escapeShellArgs cfg.extraUpFlags}
# some options cannot be set immediately
${cfg.package}/bin/tailscale up ${lib.escapeShellArgs cfg.extraUpFlags}
${cfg.package}/bin/tailscale cert ${tailnetHost}
chown nginx:nginx /var/lib/tailscale/certs/${tailnetHost}.{key,crt}
'';
# TODO nginx.service currently fails because it supposedly doesn't have permissions for this file
${cfg.package}/bin/tailscale cert ${tailnetHost}
chown nginx:nginx /var/lib/tailscale/certs/${tailnetHost}.{key,crt}
'';
};
services.nginx.virtualHosts.${tailnetHost} = {
sslCertificate = "/var/lib/tailscale/certs/${tailnetHost}.crt";