Working proxy implementation for jichan.org

hosts/desktop.nix

@@ -2,6 +2,7 @@
 
 let
   theme = import ../modules/theme;
+  tailscale = import ../modules/tailscale;
 in
 {
   services = {
@@ -59,6 +60,7 @@ in
   networking.extraHosts = ''
     192.168.0.26 elnuhub
     24.199.72.8  elnudrop
+    ${tailscale.hosts}
   '';
 
   #sound.enable = true;

hosts/desktop/default.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, ... }:
 
 {
   imports = [ (import ./hardware-configuration.nix) ];
@@ -15,6 +15,13 @@
 
   services.blueman.enable = true;
 
+  services.tailscale.enable = true;
+  networking.firewall = {
+    checkReversePath = "loose";
+    trustedInterfaces = [ "tailscale0" ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
+  };
+
   hardware.opengl = {
     enable = true;
     driSupport32Bit = true; # Required for Touhou

hosts/desktop/modules/tailscale.nix

@@ -0,0 +1,10 @@
+{ config, ... }:
+
+{
+  services.tailscale.enable = true;
+  networking.firewall = {
+    checkReversePath = "loose";
+    trustedInterfaces = [ "tailscale0" ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
+  };
+}

hosts/elnudrop/default.nix

@@ -1,48 +1,37 @@
 { lib, user, ... }:
-let keys = [
-  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEQNlGt62dBMojVCX7EUIia+wfSDfLzV4YCPi8SZ2xrp elnu@elnu.com"
-]; in
+
 {
   imports = [
     ./hardware-configuration.nix
     # Remember to update for new instances
     ./networking.nix # generated at runtime by nixos-infect
+
+    ./modules/ssh.nix
+    ./modules/headscale.nix
+    ./modules/tailscale.nix
+
+    ./hosts/jichan.org
   ];
+
   networking.firewall = {
     enable = true;
     allowedTCPPorts = [ 80 443 ];
   };
+
   security.acme = {
     acceptTerms = true;
     defaults.email = "elnu@elnu.com";
   };
+
   services.nginx = {
     enable = true;
-    virtualHosts = {
-      "default" = {
+    virtualHosts."default" = {
       default = true;
       serverName = null;
       # https://stackoverflow.com/a/42802777
       locations."/".return = "444";
     };
-      "jichan.org" = {
-        extraConfig = ''
-          error_page 502 /502.html;
-        '';
-        locations = {
-          "/" = {
-            proxyPass = "http://127.0.0.1:8000";
-            proxyWebsockets = true;
-          };
-          "/502.html".root = "${./hosts/jichan.org}";
-          "/logo.svg".root = "${./hosts/jichan.org}";
-          "/missing.min.css".root = "${./hosts/jichan.org}";
-        };
-      };
-    };
   };
+
   services.do-agent.enable = true;
-  services.openssh.enable = true;
-  users.users.root.openssh.authorizedKeys.keys = keys;
-  users.users.${user}.openssh.authorizedKeys.keys = keys;
 }

hosts/elnudrop/hosts/jichan.org/default.nix

@@ -0,0 +1,18 @@
+{
+  services.nginx.virtualHosts."jichan.org" = {
+    forceSSL = true;
+    enableACME = true;
+    extraConfig = ''
+      error_page 502 /502.html;
+    '';
+    locations = {
+      "/" = {
+        proxyPass = with import ../../../../modules/tailscale/default.nix; "http://${elnuhub}:3334";
+        proxyWebsockets = true;
+      };
+      "/502.html".root = "${./502}";
+      "/logo.svg".root = "${./502}";
+      "/missing.min.css".root = "${./502}";
+    };
+  };
+}

hosts/elnudrop/modules/headscale.nix

@@ -0,0 +1,25 @@
+{ config, ... }:
+
+let
+  baseDomain = "elnu.com";
+  domain = "headscale.${baseDomain}";
+in {
+  services.headscale = {
+    enable = true;
+    address = "0.0.0.0";
+    port = 8080;
+    settings = {
+      server_url = "https://${domain}";
+      dns_config.base_domain = baseDomain;
+    };
+  };
+  environment.systemPackages = [ config.services.headscale.package ];
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://localhost:${ toString config.services.headscale.port }";
+      proxyWebsockets = true;
+    };
+  };
+}

hosts/elnudrop/modules/ssh.nix

@@ -0,0 +1,10 @@
+{ user, ... }:
+
+let keys = [
+  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEQNlGt62dBMojVCX7EUIia+wfSDfLzV4YCPi8SZ2xrp elnu@elnu.com"
+]; in
+{
+  services.openssh.enable = true;
+  users.users.root.openssh.authorizedKeys.keys = keys;
+  users.users.${user}.openssh.authorizedKeys.keys = keys;
+}

hosts/elnudrop/modules/tailscale.nix

@@ -0,0 +1,10 @@
+{ config, ... }:
+
+{
+  services.tailscale.enable = true;
+  networking.firewall = {
+    checkReversePath = "loose";
+    trustedInterfaces = [ "tailscale0" ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
+  };
+}

modules/tailscale/default.nix

@@ -0,0 +1,8 @@
+rec {
+  elnu = "100.64.0.1";
+  elnudrop = "100.64.0.2";
+  elnuhub = "100.64.0.3";
+  hosts = ''
+    elnu ${elnu}
+  '';
+}