pegasust
/
dotfiles
1
0
Fork 0
Code Issues 6 Pull Requests Projects Releases Wiki Activity

fix: sys-nix: mosh now works, troubleshoot-writeup: c3dd64a3e2 (private atm)

nix-components
pegasust 2022-11-24 03:48:28 +00:00
parent 2e66288ce0
commit 9de22c1476
2 changed files with 100 additions and 93 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
system-nix/configuration.nix
View File

@ -74,23 +74,26 @@ with lib;
# have the job run this shell script
script = ''
# wait for tailscaled to settle
sleep 5
sleep 2
# check if we are already authenticated to tailscale
status="$(${pkgs.tailscale}/bin/tailscale status -json | ${pkgs.jq}/bin/jq -r .BackendState)"
if [ $status = "Running" ]; then # if so, then do nothing
exit 0
fi
# otherwise authenticate with tailscale
${pkgs.tailscale}/bin/tailscale up -authkey tskey-examplekeyhere
# ${pkgs.tailscale}/bin/tailscale up # blocks, doesn't give url
# This time, configure device auth so that we authenticate from portal
# https://tailscale.com/kb/1099/device-authorization/#enable-device-authorization-for-your-network
${pkgs.tailscale}/bin/tailscale up -authkey tskey-auth-kJcgTG5CNTRL-PUVFkk31z1bThHpfq3FC5b1jcMmkW2EYW
'';
};
# Don't touch networking.firewall.enable, just configure everything else.
# inherit networking;
networking = networking // {
firewall = {
checkReversePath = "loose";
trustedInterfaces = [ "tailscale0" ];
allowedUDPPorts = [ config.services.tailscale.port ];
trustedInterfaces = networking.firewall.trustedInterfaces or [] ++ [ "tailscale0" ];
allowedUDPPorts = networking.firewall.allowedUDPPorts or [] ++ [ config.services.tailscale.port ];
allowedTCPPorts = networking.firewall.allowedTCPPorts or [] ++ [ 22 ];
};
};

8
system-nix/flake.nix
View File

@ -5,7 +5,9 @@
home-manager.inputs.nixpkgs.follows = "nixpkgs";
};
outputs = { self, nixpkgs, ... }: {
outputs = { self, nixpkgs, ... }:
let lib = nixpkgs.lib; in
{
# Windows with NixOS WSL
nixosConfigurations.Felia = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
@ -80,7 +82,9 @@
address = "71.0.0.2";
prefixLength = 24;
}];
firewall.enable = false;
firewall.enable = true;
firewall.allowedTCPPorts = [ 22 ];
firewall.allowedUDPPorts = lib.range 60000 61000; # mosh
useDHCP = false;
interfaces.eth0.useDHCP = true;
};