b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

nixos/tailscale: add authKeyFile option

Browse source 
Auth key registers new nodes without needing to sign in via a browser

Tailscale sends status changes with systemd-notify.
https://github.com/tailscale/tailscale/blob/v1.44.0/ipn/ipnlocal/local.go#L3670
This commit is contained in:
Jarosław Wygoda 2023-07-10 22:31:30 +02:00
parent ae55861ec2
commit 7fc0e3334e
1 changed files with 24 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
nixos/modules/services/networking/tailscale.nix
View file

@ -49,6 +49,15 @@ in {
When set to `server` or `both`, IP forwarding will be enabled.
'';
};
authKeyFile = mkOption {
type = types.nullOr types.path;
default = null;
example = "/run/secrets/tailscale_key";
description = lib.mdDoc ''
A file containing the auth key.
'';
};
};
config = mkIf cfg.enable {
@ -82,6 +91,21 @@ in {
stopIfChanged = false;
};
systemd.services.tailscaled-autoconnect = mkIf (cfg.authKeyFile != null) {
after = ["tailscale.service"];
wants = ["tailscale.service"];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
};
script = with pkgs; ''
status=$(${config.systemd.package}/bin/systemctl show -P StatusText tailscaled.service)
if [[ $status != Connected* ]]; then
${pkgs.tailscale}/bin/tailscale up --auth-key 'file:${cfg.authKeyFile}'
fi
'';
};
boot.kernel.sysctl = mkIf (cfg.useRoutingFeatures == "server" || cfg.useRoutingFeatures == "both") {
"net.ipv4.conf.all.forwarding" = mkOverride 97 true;
"net.ipv6.conf.all.forwarding" = mkOverride 97 true;