headscale: enable DERP

nixosConfigurations/hetzner-vpn2/blog.nix

@@ -0,0 +1,43 @@
+{ pkgs, ... }:
+let
+  blog-domain-socket = "/run/nginx/blog.sock";
+  anubis-domain-socket = "/run/anubis/anubis-main/anubis.sock";
+  anubis-metrics-socket = "/run/anubis/anubis-main/anubis-metrics.sock";
+in
+{
+  systemd.services = {
+    nginx.serviceConfig.SupplementaryGroups = [ "anubis" ];
+    anubis-main.serviceConfig.SupplementaryGroups = [ "nginx" ];
+  };
+
+  services = {
+    nginx.virtualHosts = {
+      "zerforschen.plus" = {
+        enableACME = true;
+        forceSSL = true;
+        locations = {
+          "/_metrics".proxyPass = "http://unix:" + anubis-metrics-socket + ":/metrics";
+          "/".proxyPass = "http://unix:" + anubis-domain-socket;
+        };
+      };
+
+      "blog-in-anubis" = {
+        root = pkgs.zerforschen-plus-content;
+        listen = [
+          {
+            addr = "unix:" + blog-domain-socket;
+          }
+        ];
+      };
+    };
+
+    anubis.instances.main = {
+      enable = true;
+      settings = {
+        BIND = anubis-domain-socket;
+        TARGET = "unix://" + blog-domain-socket;
+        METRICS_BIND = anubis-metrics-socket;
+      };
+    };
+  };
+}

nixosConfigurations/hetzner-vpn2/default.nix

@@ -2,6 +2,8 @@
   imports = [
     ./hardware.nix
     ./nginx.nix
+    ./headscale.nix
+    ./blog.nix
   ];
 
   config = {

nixosConfigurations/hetzner-vpn2/headscale.nix

@@ -0,0 +1,43 @@
+let
+  headscale-port = 8668;
+in
+{
+  # sudo tailscale up --reset --force-reauth --login-server https://uplink.darkest.space --operator=$USER
+
+  services = {
+    headscale = {
+      enable = true;
+      address = "localhost";
+      port = headscale-port;
+      settings = {
+        server_url = "https://uplink.darkest.space/";
+        dns = {
+          override_local_dns = false;
+          base_domain = "high-gravity.space";
+        };
+        derp = {
+          server = {
+            enabled = true;
+            verify_clients = true;
+            stun_listen_addr = "0.0.0.0:3478";
+            ipv4 = "78.46.242.90";
+            ipv6 = "2a01:4f8:c013:65dd::1";
+          };
+          urls = [ ];
+        };
+      };
+    };
+
+    nginx.virtualHosts."uplink.darkest.space" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${builtins.toString headscale-port}";
+        proxyWebsockets = true;
+      };
+    };
+  };
+
+  # for DERP
+  networking.firewall.allowedUDPPorts = [ 3478 ];
+}

nixosConfigurations/hetzner-vpn2/nginx.nix

@@ -1,62 +1,19 @@
-{ pkgs, ... }:
-let
-  blog-domain-socket = "/run/nginx/blog.sock";
-  anubis-domain-socket = "/run/anubis/anubis-main/anubis.sock";
-  anubis-metrics-socket = "/run/anubis/anubis-main/anubis-metrics.sock";
-in
 {
   security.acme = {
     acceptTerms = true;
     defaults.email = "acme@zerforschen.plus";
   };
 
-  systemd.services = {
+  services.nginx = {
-    nginx.serviceConfig.SupplementaryGroups = [ "anubis" ];
+    enable = true;
-    anubis-main.serviceConfig.SupplementaryGroups = [ "nginx" ];
+    recommendedProxySettings = true;
-  };
+    recommendedTlsSettings = true;
-
+    recommendedGzipSettings = true;
-  services = {
+    recommendedOptimisation = true;
-    nginx = {
-      enable = true;
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-
-      virtualHosts = {
-        "zerforschen.plus" = {
-          addSSL = true;
-          enableACME = true;
-          locations = {
-            "/_metrics".proxyPass = "http://unix:" + anubis-metrics-socket + ":/metrics";
-            "/".proxyPass = "http://unix:" + anubis-domain-socket;
-          };
-        };
-
-        "blog-in-anubis" = {
-          root = pkgs.zerforschen-plus-content;
-          listen = [
-            {
-              addr = "unix:" + blog-domain-socket;
-            }
-          ];
-        };
-      };
-    };
-
-    anubis.instances.main = {
-      enable = true;
-      settings = {
-        BIND = anubis-domain-socket;
-        TARGET = "unix://" + blog-domain-socket;
-        METRICS_BIND = anubis-metrics-socket;
-      };
-    };
   };
 
   networking.firewall.allowedTCPPorts = [
     80
     443
-    5201
   ];
 }