WIP: router: tailscale

a

flake.lock

@@ -60,11 +60,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787540599,
-        "narHash": "sha256-MHwk52ty3NsLhq9a1IbIfBJZlCUJIdiUYFo52JLK9hY=",
+        "lastModified": 1791642191,
+        "narHash": "sha256-0bK0A59rVUn1SRZzo4cNi4VSqAe7vR1gL2/MZl53Frw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "03f4cd46bc1dd4f3a96da778d2ce9f7ce39dd450",
+        "rev": "c58f54c733a7894d84fa2fdff26cc12088c4b78c",
         "type": "github"
       },
       "original": {
@@ -135,11 +135,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1787498568,
-        "narHash": "sha256-9i/VTdusq/+NM/tz+J1Re+ojkMB8MBf0QshnYfzHz30=",
+        "lastModified": 1791594108,
+        "narHash": "sha256-XK4KceonkwD8LuMAt/vNrz982mXJM5jeHAxMwsUXXAQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "56c02bc00adcf003215cc4bd996d6efaf4cff188",
+        "rev": "6510408d147d8c5e6d76043e899e9251756f6a75",
         "type": "github"
       },
       "original": {

home/modules/fish.nix

@@ -5,11 +5,11 @@
     enable = true;
     shellInit = "set fish_greeting";
     shellAliases = {
-      # Replace ls with exa
-      ls = "exa -al --color=always --group-directories-first --icons"; # preferred listing
-      la = "exa -a --color=always --group-directories-first --icons";  # all files and dirs
-      ll = "exa -l --color=always --group-directories-first --icons";  # long format
-      lt = "exa -aT --color=always --group-directories-first --icons"; # tree listing
+      # Replace ls with eza
+      ls = "eza -al --color=always --group-directories-first --icons=always"; # preferred listing
+      la = "eza -a --color=always --group-directories-first --icons=always";  # all files and dirs
+      ll = "eza -l --color=always --group-directories-first --icons=always";  # long format
+      lt = "eza -aT --color=always --group-directories-first --icons=always"; # tree listing
       "l." = "exa -a | rg '^\.'";                                      # show only dotfiles
 
       # Replace cat with bat

hosts/Yura-PC/default.nix

@@ -31,6 +31,10 @@
     intel-media-driver # LIBVA_DRIVER_NAME=iHD
   ];
 
+  environment.systemPackages = with pkgs; [
+    lmstudio
+  ];
+
   networking.hostName = "Yura-PC"; # Define your hostname.
   networking.hostId = "110a2814"; # Required for ZFS.
 

hosts/common-desktop.nix

@@ -82,7 +82,6 @@
   # https://github.com/flatpak/flatpak/issues/2861
   xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
 
-  workarounds.flatpak.enable = true;
   fonts.packages = with pkgs; [
     fantasque-sans-mono
     nerd-fonts.fantasque-sans-mono

hosts/router/hardware-configuration.nix

@@ -14,12 +14,12 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/f222513b-ded1-49fa-b591-20ce86a2fe7f";
+    { device = "/dev/disk/by-uuid/0dec41bf-aba0-4b7b-9f61-bbb572e5bd1e";
       fsType = "ext4";
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/12CE-A600";
+    { device = "/dev/disk/by-uuid/9F5E-672F";
       fsType = "vfat";
       options = [ "fmask=0022" "dmask=0022" ];
     };

hosts/vm/default.nix

@@ -70,7 +70,6 @@
   # https://github.com/flatpak/flatpak/issues/2861
   xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
 
-#  workarounds.flatpak.enable = true;
   fonts.packages = with pkgs; [
     noto-fonts-cjk-sans
     noto-fonts-cjk-serif

modules/default.nix

@@ -1,6 +1,5 @@
 { ... }: {
   imports = [
     ./opts
-    ./workarounds
   ];
 }

modules/router/default.nix

@@ -9,6 +9,7 @@ in
       ./opts.nix
       ./ifconfig.nix
       ./wireguard.nix
+      ./tailscale.nix
       ./firewall.nix
       ./dns.nix
       ./kea.nix
@@ -27,7 +28,7 @@ in
 
   boot.loader.timeout = 2;
   boot.loader.systemd-boot.configurationLimit = 5;
-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_18;
   boot.growPartition = true;
 
   # Enable the X11 windowing system.

modules/router/dns.nix

@@ -54,17 +54,17 @@ in
       enable_dnssec = true;
       bootstrap_dns = [ "1.1.1.1" "9.9.9.9" ];
       upstream_dns = [
-        # Default upstreams
-        "quic://p0.freedns.controld.com"
-        "tls://one.one.one.one"
-        "tls://dns.quad9.net"
-
         # Adguard uses upstream and not rewrite rules to resolve cname rewrites,
         # and obviously my sysdomain entries don't exist in cloudflare.
         "[/${sysdomain}/][::1]"           # Sys domains to self (for cname rewrites)
 
         "[/${ldomain}/][::1]:1053"        # Local domains to Knot (ddns)
         "[/home/][${ifs.lan.ulaPrefix}::250]"  # .home domains to opnsense (temporary)
+
+        # Default upstreams
+        "quic://p0.freedns.controld.com"
+        "tls://one.one.one.one"
+        "tls://dns.quad9.net"
       ];
     };
     # https://adguard-dns.io/kb/general/dns-filtering-syntax/

modules/router/firewall.nix

@@ -15,6 +15,11 @@ let
         ${ifs.lan50.name},
         ${ifs.wg0.name},
     }
+    # Tailscale is its own zone, since tailnet traffic is already filtered by tailscale ACLs
+    # and needs some special handling (exit node NAT with CGNAT/ULA addrs)
+    define ZONE_TAILSCALE_IFS = { ${ifs.ts0.name} }
+    define TAILSCALE_NET4 = ${ifs.ts0.net4}
+    define TAILSCALE_NET6 = ${ifs.ts0.net6}
     define OPNSENSE_NET6 = ${vars.extra.opnsense.net6}
     define ZONE_LAN_EXTRA_NET6 = {
         # TODO: reevaluate this statement
@@ -58,6 +63,7 @@ in
               udp . 48425 : ${vars.extra.opnsense.addr4} . 48425,
               # Amnezia VPN server
               udp . 37138 : ${vars.extra.amnezia.addr4} . 37138,
+              tcp . 38247 : ${vars.extra.amnezia.addr4} . 22,
               # Minecruft server
               tcp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
               udp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
@@ -79,6 +85,8 @@ in
 
           # Masquerade LAN addrs
           oifname $ZONE_WAN_IFS ip saddr $RFC1918 masquerade
+          # Masquerade tailnet addrs (tailscale exit node)
+          oifname $ZONE_WAN_IFS ip saddr $TAILSCALE_NET4 masquerade
       }
     '';
   };
@@ -96,12 +104,28 @@ in
     '';
   };
 
+  # IPv6 masquerading for tailnet addrs only (tailscale exit node)
+  # Tailscale only assigns ULAs from $TAILSCALE_NET6, so NAT is unavoidable here
+  networking.nftables.tables.nat6_tailscale = {
+    family = "ip6";
+    content = ''
+      ${nftIdentifiers}
+      chain postrouting {
+          type nat hook postrouting priority srcnat; policy accept;
+          oifname $ZONE_WAN_IFS ip6 saddr $TAILSCALE_NET6 masquerade
+      }
+    '';
+  };
+
   networking.nftables.tables.firewall = {
     family = "inet";
     content = ''
       ${nftIdentifiers}
       define ALLOWED_TCP_PORTS = { ssh }
-      define ALLOWED_UDP_PORTS = { ${toString vars.ifs.wg0.listenPort} }
+      define ALLOWED_UDP_PORTS = {
+          ${toString vars.ifs.wg0.listenPort},
+          ${toString vars.ifs.ts0.listenPort},  # tailscale direct connections
+      }
       define ALLOWED_TCP_LAN_PORTS = { ssh, https }
       define ALLOWED_UDP_LAN_PORTS = { bootps, dhcpv6-server, domain, https }
       set port_forward_v6 {
@@ -160,6 +184,8 @@ in
           # iifname $ZONE_LAN_IFS accept
           iifname $ZONE_LAN_IFS jump zone_lan_input
           ip6 saddr $ZONE_LAN_EXTRA_NET6 jump zone_lan_input
+          # Tailscale zone input rules
+          iifname $ZONE_TAILSCALE_IFS jump zone_tailscale_input
 
           # log
       }
@@ -175,6 +201,8 @@ in
           # LAN zone forward rules
           iifname $ZONE_LAN_IFS jump zone_lan_forward
           ip6 saddr $ZONE_LAN_EXTRA_NET6 jump zone_lan_forward
+          # Tailscale zone forward rules
+          iifname $ZONE_TAILSCALE_IFS jump zone_tailscale_forward
       }
 
       chain zone_wan_input {
@@ -214,6 +242,23 @@ in
 
           # Allow traffic between LANs
           oifname $ZONE_LAN_IFS accept
+
+          # Allow LAN to reach tailnet (no SNAT, tailnet peers see real LAN addrs)
+          oifname $ZONE_TAILSCALE_IFS accept
+      }
+
+      chain zone_tailscale_input {
+          # Tailnet access is restricted by tailscale ACLs, treat like LAN
+          jump zone_lan_input
+      }
+
+      chain zone_tailscale_forward {
+          # Subnet router: allow tailnet to LANs (advertised routes)
+          oifname $ZONE_LAN_IFS accept
+
+          # Exit node: allow tailnet to WAN (masqueraded in nat4 / nat6_tailscale)
+          oifname $ZONE_WAN_IFS ip saddr $TAILSCALE_NET4 accept
+          oifname $ZONE_WAN_IFS ip6 saddr $TAILSCALE_NET6 accept
       }
 
       chain output {

modules/router/ifconfig.nix

@@ -52,6 +52,9 @@ in
   # since my WAN and LAN20 are technically bridged.
   # https://networkengineering.stackexchange.com/questions/83071/why-linux-answers-arp-requests-for-ips-that-belong-to-different-network-interfac
   boot.kernel.sysctl."net.ipv4.conf.default.arp_filter" = 1;
+  # Later I discovered that rp_filter might also be good to set
+  # Strict mode (1) drops packets if the src ip isn't a local route on the interface
+  boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = 1;
 
   # It is impossible to do multiple prefix requests with networkd,
   # so I use dhcpcd for this

modules/router/secrets/grafana-secret-key.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 D2MY/A txjDSEsRr2CJtC9rDIiY9H8aX0us53vhnqJStt+XvlA
+vjmrx5ByEhbHE/hBEQq3gRqY8b5/mjHLs+He3D/27LM
+--- rp66vDf9qnM7f9S5YD/X/99YsufPWmvz+V8z8htB2Ow
+9‡Ài¨*¡-oš·}Ć(Š5[¬[ÕyKr)¾-­cùäóŽù¼R0?Ë8`Èô×{

modules/router/services.nix

@@ -29,10 +29,12 @@ in
   };
 
   # https://wiki.nixos.org/wiki/Grafana#Declarative_configuration
+  secrix.services.grafana.secrets.security-key.encrypted.file = ./secrets/grafana-secret-key.age;
   services.grafana = {
     enable = true;
     settings = {
       security.allow_embedding = true;
+      security.secret_key = "$__file{${config.secrix.services.grafana.secrets.security-key.decrypted.path}}";
       server = {
         http_port = 3001;
         domain = "grouter.${domain}";
@@ -57,8 +59,8 @@ in
   services.caddy = {
     enable = true;
     package = pkgs.caddy.withPlugins {
-      plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-      hash = "sha256-F7d4HwM4oCkQrFMr4SFSC0r52ONxY+PW6z5BJawW8Ok=";
+      plugins = [ "github.com/caddy-dns/cloudflare@v0.2.4" ];
+      hash = "sha256-xRJ5evsAJ2akg47j3Bt6YDXJOgX88B/rKNP50KSVyNY=";
     };
     virtualHosts."*.${domain}".extraConfig = ''
       encode

modules/router/tailscale.nix

@@ -0,0 +1,44 @@
+{ config, lib, pkgs, ... }:
+let
+  vars = import ./vars.nix config;
+  ifs = vars.ifs;
+  ts0 = ifs.ts0;
+
+  # Subnets advertised to the tailnet (still need to be approved in the admin console)
+  advertisedRoutes = [
+    "${vars.p4}.0.0/16"          # all LAN v4 subnets
+    "${vars.ulaPrefix}::/48"     # all LAN ULA subnets
+  ];
+in
+{
+  # One-time setup after deploying: `sudo tailscale up`
+  # (state is persisted in /var/lib/tailscale)
+  services.tailscale = {
+    enable = true;
+    port = ts0.listenPort;
+    interfaceName = ts0.name;
+    # Enables ip forwarding (already enabled globally by networkd anyway).
+    # Not using "both", since that sets rp_filter to loose on all interfaces.
+    useRoutingFeatures = "server";
+    # Firewall is managed manually in firewall.nix (networking.firewall is disabled)
+    openFirewall = false;
+    # Applied with `tailscale set` on every start, so these stay declarative
+    extraSetFlags = [
+      # Don't let tailscale touch nftables/iptables, all rules live in firewall.nix
+      "--netfilter-mode=off"
+      # Don't SNAT tailnet -> LAN traffic, LAN hosts route back via the router anyway
+      # (preserves real source addrs for logging/ACLs on LAN hosts)
+      "--snat-subnet-routes=false"
+      # The router is its own DNS server, don't let tailscale mess with resolv.conf
+      "--accept-dns=false"
+      "--advertise-routes=${lib.strings.concatStringsSep "," advertisedRoutes}"
+      "--advertise-exit-node"
+    ];
+  };
+
+  # networkd removes "foreign" ip rules when it (re)starts, which would wipe tailscale's
+  # policy routing rules (table 52). This is extra important since networkd is
+  # restarted every minute (see ifconfig.nix).
+  # The nixpkgs tailscale module already marks tailscale0 as unmanaged in networkd.
+  systemd.network.config.networkConfig.ManageForeignRoutingPolicyRules = false;
+}

modules/router/vars.nix

@@ -111,6 +111,14 @@ rec {
     } // {
       listenPort = 51944;
     };
+    # Tailscale addresses are assigned by the coordination server,
+    # these are the fixed ranges tailscale allocates node addrs from.
+    ts0 = {
+      name = "tailscale0";
+      listenPort = 41641;
+      net4 = "100.64.0.0/10";
+      net6 = "fd7a:115c:a1e0::/48";
+    };
   };
 
   extra = {

modules/workarounds/default.nix

@@ -1,5 +0,0 @@
-{
-  imports = [
-    ./flatpak.nix
-  ];
-}

modules/workarounds/flatpak.nix

@@ -1,44 +0,0 @@
-# https://github.com/knightpp/nixos-cfg/blob/main/modules/workarounds/flatpak.nix
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.workarounds.flatpak;
-in {
-  options = {
-    workarounds.flatpak = {
-      enable = lib.mkEnableOption "flatpak workaround";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    system.fsPackages = [pkgs.bindfs];
-    fileSystems = let
-      mkRoSymBind = path: {
-        device = path;
-        fsType = "fuse.bindfs";
-        options = ["ro" "resolve-symlinks" "x-gvfs-hide"];
-      };
-      aggregated = pkgs.buildEnv {
-        name = "system-fonts-and-icons";
-        paths = builtins.attrValues {
-          inherit (pkgs.kdePackages) breeze;
-          inherit
-            (pkgs)
-            noto-fonts
-            noto-fonts-color-emoji
-            noto-fonts-cjk-sans
-            noto-fonts-cjk-serif
-            ;
-        };
-        pathsToLink = ["/share/fonts" "/share/icons"];
-      };
-    in {
-      # Create an FHS mount to support flatpak host icons/fonts
-      "/usr/share/icons" = mkRoSymBind "${aggregated}/share/icons";
-      "/usr/share/fonts" = mkRoSymBind "${aggregated}/share/fonts";
-    };
-  };
-}