From bbedc6d466ef240c2ff1956e4155fdeb8dfc6d78 Mon Sep 17 00:00:00 2001
From: seth <getchoo@tuta.io>
Date: Sun, 14 May 2023 09:03:44 -0400
Subject: hosts: start using tailscale + endlessh -> fail2ban

---
 modules/nixos/features/tailscale.nix | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 modules/nixos/features/tailscale.nix

(limited to 'modules/nixos/features')

diff --git a/modules/nixos/features/tailscale.nix b/modules/nixos/features/tailscale.nix
new file mode 100644
index 0000000..d2c8b20
--- /dev/null
+++ b/modules/nixos/features/tailscale.nix
@@ -0,0 +1,23 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.getchoo.features.tailscale;
+  inherit (lib) mkDefault mkEnableOption mkIf;
+in {
+  options.getchoo.features.tailscale.enable = mkEnableOption "enable support for tailscale";
+
+  config = mkIf cfg.enable {
+    services = {
+      openssh.openFirewall = false;
+      tailscale.enable = mkDefault true;
+    };
+
+    networking.firewall = {
+      allowedUDPPorts = [config.services.tailscale.port];
+      checkReversePath = "loose";
+      trustedInterfaces = mkDefault ["tailscale0"];
+    };
+  };
+}
-- 
cgit v1.2.3