45 lines
1.8 KiB
Nix
45 lines
1.8 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
let
|
|
vars = import ./vars.nix config;
|
|
ifs = vars.ifs;
|
|
ts0 = ifs.ts0;
|
|
|
|
# Subnets advertised to the tailnet (still need to be approved in the admin console)
|
|
advertisedRoutes = [
|
|
"${vars.p4}.0.0/16" # all LAN v4 subnets
|
|
"${vars.ulaPrefix}::/48" # all LAN ULA subnets
|
|
];
|
|
in
|
|
{
|
|
# One-time setup after deploying: `sudo tailscale up`
|
|
# (state is persisted in /var/lib/tailscale)
|
|
services.tailscale = {
|
|
enable = true;
|
|
port = ts0.listenPort;
|
|
interfaceName = ts0.name;
|
|
# Enables ip forwarding (already enabled globally by networkd anyway).
|
|
# Not using "both", since that sets rp_filter to loose on all interfaces.
|
|
useRoutingFeatures = "server";
|
|
# Firewall is managed manually in firewall.nix (networking.firewall is disabled)
|
|
openFirewall = false;
|
|
# Applied with `tailscale set` on every start, so these stay declarative
|
|
extraSetFlags = [
|
|
# Don't let tailscale touch nftables/iptables, all rules live in firewall.nix
|
|
"--netfilter-mode=off"
|
|
# Don't SNAT tailnet -> LAN traffic, LAN hosts route back via the router anyway
|
|
# (preserves real source addrs for logging/ACLs on LAN hosts)
|
|
"--snat-subnet-routes=false"
|
|
# The router is its own DNS server, don't let tailscale mess with resolv.conf
|
|
"--accept-dns=false"
|
|
"--advertise-routes=${lib.strings.concatStringsSep "," advertisedRoutes}"
|
|
"--advertise-exit-node"
|
|
];
|
|
};
|
|
|
|
# networkd removes "foreign" ip rules when it (re)starts, which would wipe tailscale's
|
|
# policy routing rules (table 52). This is extra important since networkd is
|
|
# restarted every minute (see ifconfig.nix).
|
|
# The nixpkgs tailscale module already marks tailscale0 as unmanaged in networkd.
|
|
systemd.network.config.networkConfig.ManageForeignRoutingPolicyRules = false;
|
|
}
|