hosts: start using tailscale + endlessh -> fail2ban

1 files changed, 23 insertions, 0 deletions

diff --git a/modules/nixos/features/tailscale.nix b/modules/nixos/features/tailscale.nix
new file mode 100644
index 0000000..d2c8b20
--- /dev/null
+++ b/modules/nixos/features/tailscale.nix
@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.getchoo.features.tailscale;
+  inherit (lib) mkDefault mkEnableOption mkIf;
+in {
+  options.getchoo.features.tailscale.enable = mkEnableOption "enable support for tailscale";
+
+  config = mkIf cfg.enable {
+    services = {
+      openssh.openFirewall = false;
+      tailscale.enable = mkDefault true;
+    };
+
+    networking.firewall = {
+      allowedUDPPorts = [config.services.tailscale.port];
+      checkReversePath = "loose";
+      trustedInterfaces = mkDefault ["tailscale0"];
+    };
+  };
+}