hosts: start using tailscale + endlessh -> fail2ban

5 files changed, 38 insertions, 15 deletions

diff --git a/hosts/glados-wsl/default.nix b/hosts/glados-wsl/default.nix
index a05f3ea..33770eb 100644
--- a/hosts/glados-wsl/default.nix
+++ b/hosts/glados-wsl/default.nix
@@ -5,13 +5,17 @@
 }: {
   imports = [
     (modulesPath + "/profiles/minimal.nix")
+    ../../modules/nixos/features/tailscale.nix
   ];
 
   environment.systemPackages = with pkgs; [
     wslu
   ];
 
-  getchoo.base.networking.enable = false;
+  getchoo = {
+    base.networking.enable = false;
+    features.tailscale.enable = true;
+  };
 
   wsl = {
     enable = true;
diff --git a/hosts/glados/default.nix b/hosts/glados/default.nix
index 4aef9e7..c05f08a 100644
--- a/hosts/glados/default.nix
+++ b/hosts/glados/default.nix
@@ -2,11 +2,13 @@ _: {
   imports = [
     ./boot.nix
     ./hardware-configuration.nix
+    ../../modules/nixos/features/tailscale.nix
   ];
 
   getchoo = {
     base.virtualisation.enable = true;
     desktop.gnome.enable = true;
+    features.tailscale.enable = true;
     hardware = {
       enable = true;
       nvidia.enable = true;
diff --git a/hosts/profiles.nix b/hosts/profiles.nix
index 21f0a90..f0903e5 100644
--- a/hosts/profiles.nix
+++ b/hosts/profiles.nix
@@ -70,8 +70,10 @@ in {
       ragenix.nixosModules.default
       ../modules/nixos/base
       ../modules/nixos/server
+      ../modules/nixos/features/tailscale.nix
 
       {
+        getchoo.features.tailscale.enable = true;
         getchoo.server.enable = true;
         nix.registry.nixpkgs.flake = nixpkgs;
       }
diff --git a/modules/nixos/features/tailscale.nix b/modules/nixos/features/tailscale.nix
new file mode 100644
index 0000000..d2c8b20
--- /dev/null
+++ b/modules/nixos/features/tailscale.nix
@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.getchoo.features.tailscale;
+  inherit (lib) mkDefault mkEnableOption mkIf;
+in {
+  options.getchoo.features.tailscale.enable = mkEnableOption "enable support for tailscale";
+
+  config = mkIf cfg.enable {
+    services = {
+      openssh.openFirewall = false;
+      tailscale.enable = mkDefault true;
+    };
+
+    networking.firewall = {
+      allowedUDPPorts = [config.services.tailscale.port];
+      checkReversePath = "loose";
+      trustedInterfaces = mkDefault ["tailscale0"];
+    };
+  };
+}
diff --git a/modules/nixos/server/default.nix b/modules/nixos/server/default.nix
index 504a333..210484e 100644
--- a/modules/nixos/server/default.nix
+++ b/modules/nixos/server/default.nix
@@ -24,15 +24,6 @@ in {
 
     environment.systemPackages = [pkgs.cachix];
 
-    networking = {
-      firewall = let
-        ports = [80 420];
-      in {
-        allowedUDPPorts = ports;
-        allowedTCPPorts = ports;
-      };
-    };
-
     nix = {
       gc.options = "--delete-older-than 7d --max-freed 50G";
       settings = {
@@ -63,16 +54,17 @@ in {
     };
 
     services = {
-      endlessh = {
-        enable = mkDefault true;
-        port = mkDefault 22;
-        openFirewall = mkDefault true;
+      fail2ban = {
+        enable = true;
+        bantime-increment = {
+          enable = true;
+        };
+        maxretry = 5;
       };
 
       openssh = {
         enable = true;
         passwordAuthentication = mkDefault false;
-        ports = mkDefault [420];
       };
     };
   };