pegasust
/
dotfiles
1
0
Fork 0
Code Issues 6 Pull Requests Projects Releases Wiki Activity

fix: sys-nix: mosh now works, troubleshoot-writeup: c3dd64a3e2 (private atm)

nix-components
pegasust 2022-11-24 03:48:28 +00:00
parent 2e66288ce0
commit 9de22c1476
2 changed files with 100 additions and 93 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
system-nix/configuration.nix
View File

@ -74,23 +74,26 @@ with lib;
# have the job run this shell script # have the job run this shell script
script = '' script = ''
# wait for tailscaled to settle # wait for tailscaled to settle
sleep 5 sleep 2
# check if we are already authenticated to tailscale # check if we are already authenticated to tailscale
status="$(${pkgs.tailscale}/bin/tailscale status -json | ${pkgs.jq}/bin/jq -r .BackendState)" status="$(${pkgs.tailscale}/bin/tailscale status -json | ${pkgs.jq}/bin/jq -r .BackendState)"
if [ $status = "Running" ]; then # if so, then do nothing if [ $status = "Running" ]; then # if so, then do nothing
exit 0 exit 0
fi fi
# otherwise authenticate with tailscale
${pkgs.tailscale}/bin/tailscale up -authkey tskey-examplekeyhere # ${pkgs.tailscale}/bin/tailscale up # blocks, doesn't give url
# This time, configure device auth so that we authenticate from portal
# https://tailscale.com/kb/1099/device-authorization/#enable-device-authorization-for-your-network
${pkgs.tailscale}/bin/tailscale up -authkey tskey-auth-kJcgTG5CNTRL-PUVFkk31z1bThHpfq3FC5b1jcMmkW2EYW
''; '';
}; };
# Don't touch networking.firewall.enable, just configure everything else. # Don't touch networking.firewall.enable, just configure everything else.
# inherit networking; # inherit networking;
networking = networking // { networking = networking // {
firewall = { firewall = {
checkReversePath = "loose"; trustedInterfaces = networking.firewall.trustedInterfaces or [] ++ [ "tailscale0" ];
trustedInterfaces = [ "tailscale0" ]; allowedUDPPorts = networking.firewall.allowedUDPPorts or [] ++ [ config.services.tailscale.port ];
allowedUDPPorts = [ config.services.tailscale.port ]; allowedTCPPorts = networking.firewall.allowedTCPPorts or [] ++ [ 22 ];
}; };
}; };

8
system-nix/flake.nix
View File

@ -5,7 +5,9 @@
home-manager.inputs.nixpkgs.follows = "nixpkgs"; home-manager.inputs.nixpkgs.follows = "nixpkgs";
}; };
outputs = { self, nixpkgs, ... }: { outputs = { self, nixpkgs, ... }:
let lib = nixpkgs.lib; in
{
# Windows with NixOS WSL # Windows with NixOS WSL
nixosConfigurations.Felia = nixpkgs.lib.nixosSystem { nixosConfigurations.Felia = nixpkgs.lib.nixosSystem {
system = "x86_64-linux"; system = "x86_64-linux";
@ -80,7 +82,9 @@
address = "71.0.0.2"; address = "71.0.0.2";
prefixLength = 24; prefixLength = 24;
}]; }];
firewall.enable = false; firewall.enable = true;
firewall.allowedTCPPorts = [ 22 ];
firewall.allowedUDPPorts = lib.range 60000 61000; # mosh
useDHCP = false; useDHCP = false;
interfaces.eth0.useDHCP = true; interfaces.eth0.useDHCP = true;
}; };