nrabulinski/settei
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

treewide: move tailscale to separate module

Browse source
This commit is contained in:
Nikodem Rabuliński 2024-07-19 21:24:42 +02:00 • committed by Nikodem Rabuliński
parent 05300b82cf
commit 6d8c8a8f52
9 changed files with 102 additions and 53 deletions
Download patch file Download diff file Expand all files Collapse all files

71
modules/system/settei/sane-defaults.nix
View file

@ -11,10 +11,6 @@ let
type = types.attrsOf types.singleLineStr;
default = { };
};
tailnet = mkOption {
type = types.nullOr types.str;
default = null;
};
};
};
@ -27,9 +23,6 @@ let
username = lib.mkDefault username;
};
# FIXME: Move to common
services.tailscale.enable = true;
networking.hostName = lib.mkDefault (
args.configurationName
or (throw "pass configurationName to module arguments or set networking.hostName yourself")
@ -79,54 +72,28 @@ let
};
};
linuxConfig = lib.optionalAttrs isLinux (
let
nmEnabled = config.networking.networkmanager.enable;
tlEnabled = config.services.tailscale.enable;
in
lib.mkMerge [
{
hardware.enableRedistributableFirmware = true;
linuxConfig = lib.optionalAttrs isLinux {
hardware.enableRedistributableFirmware = true;
# FIXME: Move to common
networking.firewall.trustedInterfaces = lib.mkIf tlEnabled [ "tailscale0" ];
services.openssh.enable = true;
programs.mosh.enable = lib.mkDefault true;
programs.git.enable = lib.mkDefault true;
services.openssh.enable = true;
programs.mosh.enable = lib.mkDefault true;
programs.git.enable = lib.mkDefault true;
users = {
mutableUsers = false;
users.${username} = {
isNormalUser = true;
home = "/home/${username}";
group = username;
extraGroups = [ "wheel" ];
};
groups.${username} = { };
};
users = {
mutableUsers = false;
users.${username} = {
isNormalUser = true;
home = "/home/${username}";
group = username;
extraGroups = [ "wheel" ];
};
groups.${username} = { };
};
# TODO: Actually this should be extraRules which makes wheel users without any password set
# be able to use sudo with no password
security.sudo.wheelNeedsPassword = false;
}
{
# When NetworkManager isn't in use, add tailscale DNS address manually
# FIXME: Move to common
networking = lib.mkIf (!nmEnabled && tlEnabled && cfg.tailnet != null) {
nameservers = [
"100.100.100.100"
"1.1.1.1"
"1.0.0.1"
];
search = [ cfg.tailnet ];
};
# NetworkManager probably means desktop system so we don't want to slow down boot times
systemd.services = lib.mkIf nmEnabled { NetworkManager-wait-online.enable = false; };
}
]
);
# TODO: Actually this should be extraRules which makes wheel users without any password set
# be able to use sudo with no password
security.sudo.wheelNeedsPassword = false;
};
darwinConfig = lib.optionalAttrs (!isLinux) {
services.nix-daemon.enable = true;