blob: a5d171e0baabe314b6ef8d5b9b860e9f39b24fe5 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
|
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.tailscale;
isNetworkd = config.networking.useNetworkd;
in {
meta.maintainers = with maintainers; [ danderson mbaillie twitchyliquid64 mfrw ];
options.services.tailscale = {
enable = mkEnableOption (lib.mdDoc "Tailscale client daemon");
port = mkOption {
type = types.port;
default = 41641;
description = lib.mdDoc "The port to listen on for tunnel traffic (0=autoselect).";
};
interfaceName = mkOption {
type = types.str;
default = "tailscale0";
description = lib.mdDoc ''The interface name for tunnel traffic. Use "userspace-networking" (beta) to not use TUN.'';
};
permitCertUid = mkOption {
type = types.nullOr types.nonEmptyStr;
default = null;
description = lib.mdDoc "Username or user ID of the user allowed to to fetch Tailscale TLS certificates for the node.";
};
package = lib.mkPackageOptionMD pkgs "tailscale" {};
openFirewall = mkOption {
default = false;
type = types.bool;
description = lib.mdDoc "Whether to open the firewall for the specified port.";
};
useRoutingFeatures = mkOption {
type = types.enum [ "none" "client" "server" "both" ];
default = "none";
example = "server";
description = lib.mdDoc ''
Enables settings required for Tailscale's routing features like subnet routers and exit nodes.
To use these these features, you will still need to call `sudo tailscale up` with the relevant flags like `--advertise-exit-node` and `--exit-node`.
When set to `client` or `both`, reverse path filtering will be set to loose instead of strict.
When set to `server` or `both`, IP forwarding will be enabled.
'';
};
authKeyFile = mkOption {
type = types.nullOr types.path;
default = null;
example = "/run/secrets/tailscale_key";
description = lib.mdDoc ''
A file containing the auth key.
'';
};
extraUpFlags = mkOption {
description = lib.mdDoc "Extra flags to pass to {command}`tailscale up`.";
type = types.listOf types.str;
default = [];
example = ["--ssh"];
};
};
config = mkIf cfg.enable {
environment.systemPackages = [ cfg.package ]; # for the CLI
systemd.packages = [ cfg.package ];
systemd.services.tailscaled = {
wantedBy = [ "multi-user.target" ];
path = [
config.networking.resolvconf.package # for configuring DNS in some configs
pkgs.procps # for collecting running services (opt-in feature)
pkgs.getent # for `getent` to look up user shells
pkgs.kmod # required to pass tailscale's v6nat check
];
serviceConfig.Environment = [
"PORT=${toString cfg.port}"
''"FLAGS=--tun ${lib.escapeShellArg cfg.interfaceName}"''
] ++ (lib.optionals (cfg.permitCertUid != null) [
"TS_PERMIT_CERT_UID=${cfg.permitCertUid}"
]);
# Restart tailscaled with a single `systemctl restart` at the
# end of activation, rather than a `stop` followed by a later
# `start`. Activation over Tailscale can hang for tens of
# seconds in the stop+start setup, if the activation script has
# a significant delay between the stop and start phases
# (e.g. script blocked on another unit with a slow shutdown).
#
# Tailscale is aware of the correctness tradeoff involved, and
# already makes its upstream systemd unit robust against unit
# version mismatches on restart for compatibility with other
# linux distros.
stopIfChanged = false;
};
systemd.services.tailscaled-autoconnect = mkIf (cfg.authKeyFile != null) {
after = ["tailscale.service"];
wants = ["tailscale.service"];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
};
script = ''
status=$(${config.systemd.package}/bin/systemctl show -P StatusText tailscaled.service)
if [[ $status != Connected* ]]; then
${cfg.package}/bin/tailscale up --auth-key 'file:${cfg.authKeyFile}' ${escapeShellArgs cfg.extraUpFlags}
fi
'';
};
boot.kernel.sysctl = mkIf (cfg.useRoutingFeatures == "server" || cfg.useRoutingFeatures == "both") {
"net.ipv4.conf.all.forwarding" = mkOverride 97 true;
"net.ipv6.conf.all.forwarding" = mkOverride 97 true;
};
networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ cfg.port ];
networking.firewall.checkReversePath = mkIf (cfg.useRoutingFeatures == "client" || cfg.useRoutingFeatures == "both") "loose";
networking.dhcpcd.denyInterfaces = [ cfg.interfaceName ];
systemd.network.networks."50-tailscale" = mkIf isNetworkd {
matchConfig = {
Name = cfg.interfaceName;
};
linkConfig = {
Unmanaged = true;
ActivationPolicy = "manual";
};
};
};
}
|