From 24b0fcf632c5d7b29af4b2ba7f368197440430c1 Mon Sep 17 00:00:00 2001 From: Vinzenz Schroeter Date: Sun, 4 Jan 2026 20:16:56 +0100 Subject: [PATCH 1/4] add headscale --- nixosConfigurations/hetzner-vpn2/default.nix | 1 + .../hetzner-vpn2/headscale.nix | 26 +++++++++++++++++++ 2 files changed, 27 insertions(+) create mode 100644 nixosConfigurations/hetzner-vpn2/headscale.nix diff --git a/nixosConfigurations/hetzner-vpn2/default.nix b/nixosConfigurations/hetzner-vpn2/default.nix index 591dc20..5ad0e0f 100644 --- a/nixosConfigurations/hetzner-vpn2/default.nix +++ b/nixosConfigurations/hetzner-vpn2/default.nix @@ -2,6 +2,7 @@ imports = [ ./hardware.nix ./nginx.nix + ./headscale.nix ]; config = { diff --git a/nixosConfigurations/hetzner-vpn2/headscale.nix b/nixosConfigurations/hetzner-vpn2/headscale.nix new file mode 100644 index 0000000..538c557 --- /dev/null +++ b/nixosConfigurations/hetzner-vpn2/headscale.nix @@ -0,0 +1,26 @@ +let + headscale-port = 8668; +in +{ + services = { + headscale = { + enable = true; + address = "localhost"; + port = headscale-port; + settings = { + server_url = "https://headscale.zerforschen.plus"; + dns = { + override_local_dns = false; + base_domain = "high-gravity.space"; + }; + }; + }; + nginx.virtualHosts."uplink.darkest.space" = { + addSSL = true; + enableACME = true; + locations = { + "/".proxyPass = "http://localhost:${builtins.toString headscale-port}"; + }; + }; + }; +} From 040bb41705888c0fe625f8d96ecdfd6cc7af7fa4 Mon Sep 17 00:00:00 2001 From: Vinzenz Schroeter Date: Sun, 4 Jan 2026 20:17:22 +0100 Subject: [PATCH 2/4] vpn2: split nginx config --- nixosConfigurations/hetzner-vpn2/blog.nix | 43 +++++++++++++++ nixosConfigurations/hetzner-vpn2/default.nix | 1 + nixosConfigurations/hetzner-vpn2/nginx.nix | 55 +++----------------- 3 files changed, 50 insertions(+), 49 deletions(-) create mode 100644 nixosConfigurations/hetzner-vpn2/blog.nix diff --git a/nixosConfigurations/hetzner-vpn2/blog.nix b/nixosConfigurations/hetzner-vpn2/blog.nix new file mode 100644 index 0000000..4b29cb3 --- /dev/null +++ b/nixosConfigurations/hetzner-vpn2/blog.nix @@ -0,0 +1,43 @@ +{ pkgs, ... }: +let + blog-domain-socket = "/run/nginx/blog.sock"; + anubis-domain-socket = "/run/anubis/anubis-main/anubis.sock"; + anubis-metrics-socket = "/run/anubis/anubis-main/anubis-metrics.sock"; +in +{ + systemd.services = { + nginx.serviceConfig.SupplementaryGroups = [ "anubis" ]; + anubis-main.serviceConfig.SupplementaryGroups = [ "nginx" ]; + }; + + services = { + nginx.virtualHosts = { + "zerforschen.plus" = { + addSSL = true; + enableACME = true; + locations = { + "/_metrics".proxyPass = "http://unix:" + anubis-metrics-socket + ":/metrics"; + "/".proxyPass = "http://unix:" + anubis-domain-socket; + }; + }; + + "blog-in-anubis" = { + root = pkgs.zerforschen-plus-content; + listen = [ + { + addr = "unix:" + blog-domain-socket; + } + ]; + }; + }; + + anubis.instances.main = { + enable = true; + settings = { + BIND = anubis-domain-socket; + TARGET = "unix://" + blog-domain-socket; + METRICS_BIND = anubis-metrics-socket; + }; + }; + }; +} diff --git a/nixosConfigurations/hetzner-vpn2/default.nix b/nixosConfigurations/hetzner-vpn2/default.nix index 5ad0e0f..cc53cb3 100644 --- a/nixosConfigurations/hetzner-vpn2/default.nix +++ b/nixosConfigurations/hetzner-vpn2/default.nix @@ -3,6 +3,7 @@ ./hardware.nix ./nginx.nix ./headscale.nix + ./blog.nix ]; config = { diff --git a/nixosConfigurations/hetzner-vpn2/nginx.nix b/nixosConfigurations/hetzner-vpn2/nginx.nix index aa399aa..7178b0d 100644 --- a/nixosConfigurations/hetzner-vpn2/nginx.nix +++ b/nixosConfigurations/hetzner-vpn2/nginx.nix @@ -1,62 +1,19 @@ -{ pkgs, ... }: -let - blog-domain-socket = "/run/nginx/blog.sock"; - anubis-domain-socket = "/run/anubis/anubis-main/anubis.sock"; - anubis-metrics-socket = "/run/anubis/anubis-main/anubis-metrics.sock"; -in { security.acme = { acceptTerms = true; defaults.email = "acme@zerforschen.plus"; }; - systemd.services = { - nginx.serviceConfig.SupplementaryGroups = [ "anubis" ]; - anubis-main.serviceConfig.SupplementaryGroups = [ "nginx" ]; - }; - - services = { - nginx = { - enable = true; - recommendedProxySettings = true; - recommendedTlsSettings = true; - recommendedGzipSettings = true; - recommendedOptimisation = true; - - virtualHosts = { - "zerforschen.plus" = { - addSSL = true; - enableACME = true; - locations = { - "/_metrics".proxyPass = "http://unix:" + anubis-metrics-socket + ":/metrics"; - "/".proxyPass = "http://unix:" + anubis-domain-socket; - }; - }; - - "blog-in-anubis" = { - root = pkgs.zerforschen-plus-content; - listen = [ - { - addr = "unix:" + blog-domain-socket; - } - ]; - }; - }; - }; - - anubis.instances.main = { - enable = true; - settings = { - BIND = anubis-domain-socket; - TARGET = "unix://" + blog-domain-socket; - METRICS_BIND = anubis-metrics-socket; - }; - }; + services.nginx = { + enable = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; }; networking.firewall.allowedTCPPorts = [ 80 443 - 5201 ]; } From a66dfe0b95f91a9afea602941a26d6c943ae0f23 Mon Sep 17 00:00:00 2001 From: Vinzenz Schroeter Date: Sun, 4 Jan 2026 20:51:42 +0100 Subject: [PATCH 3/4] headscale/blog: fix url, force ssl, proxy websockets --- nixosConfigurations/hetzner-vpn2/blog.nix | 2 +- nixosConfigurations/hetzner-vpn2/headscale.nix | 9 +++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/nixosConfigurations/hetzner-vpn2/blog.nix b/nixosConfigurations/hetzner-vpn2/blog.nix index 4b29cb3..367ef2b 100644 --- a/nixosConfigurations/hetzner-vpn2/blog.nix +++ b/nixosConfigurations/hetzner-vpn2/blog.nix @@ -13,8 +13,8 @@ in services = { nginx.virtualHosts = { "zerforschen.plus" = { - addSSL = true; enableACME = true; + forceSSL = true; locations = { "/_metrics".proxyPass = "http://unix:" + anubis-metrics-socket + ":/metrics"; "/".proxyPass = "http://unix:" + anubis-domain-socket; diff --git a/nixosConfigurations/hetzner-vpn2/headscale.nix b/nixosConfigurations/hetzner-vpn2/headscale.nix index 538c557..43eda08 100644 --- a/nixosConfigurations/hetzner-vpn2/headscale.nix +++ b/nixosConfigurations/hetzner-vpn2/headscale.nix @@ -8,7 +8,7 @@ in address = "localhost"; port = headscale-port; settings = { - server_url = "https://headscale.zerforschen.plus"; + server_url = "https://uplink.darkest.space/"; dns = { override_local_dns = false; base_domain = "high-gravity.space"; @@ -16,10 +16,11 @@ in }; }; nginx.virtualHosts."uplink.darkest.space" = { - addSSL = true; enableACME = true; - locations = { - "/".proxyPass = "http://localhost:${builtins.toString headscale-port}"; + forceSSL = true; + locations."/" = { + proxyPass = "http://localhost:${builtins.toString headscale-port}"; + proxyWebsockets = true; }; }; }; From f5728963e648fdc768808d2a32ffacdd3716a4a5 Mon Sep 17 00:00:00 2001 From: Vinzenz Schroeter Date: Sun, 4 Jan 2026 21:59:05 +0100 Subject: [PATCH 4/4] headscale: enable DERP --- nixosConfigurations/hetzner-vpn2/headscale.nix | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/nixosConfigurations/hetzner-vpn2/headscale.nix b/nixosConfigurations/hetzner-vpn2/headscale.nix index 43eda08..6eac407 100644 --- a/nixosConfigurations/hetzner-vpn2/headscale.nix +++ b/nixosConfigurations/hetzner-vpn2/headscale.nix @@ -2,6 +2,8 @@ let headscale-port = 8668; in { + # sudo tailscale up --reset --force-reauth --login-server https://uplink.darkest.space --operator=$USER + services = { headscale = { enable = true; @@ -13,8 +15,19 @@ in override_local_dns = false; base_domain = "high-gravity.space"; }; + derp = { + server = { + enabled = true; + verify_clients = true; + stun_listen_addr = "0.0.0.0:3478"; + ipv4 = "78.46.242.90"; + ipv6 = "2a01:4f8:c013:65dd::1"; + }; + urls = [ ]; + }; }; }; + nginx.virtualHosts."uplink.darkest.space" = { enableACME = true; forceSSL = true; @@ -24,4 +37,7 @@ in }; }; }; + + # for DERP + networking.firewall.allowedUDPPorts = [ 3478 ]; }