74 lines
2.7 KiB
Nix
74 lines
2.7 KiB
Nix
{
|
|
description = "tsnet-proxy: proxy onto tsnet";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
|
gomod2nix.url = "github:nix-community/gomod2nix";
|
|
gomod2nix.inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
|
|
outputs = { self, nixpkgs, gomod2nix, systems }: let
|
|
eachSystem = f: nixpkgs.lib.genAttrs (import systems) (system: f rec {
|
|
inherit system;
|
|
pkgs = nixpkgs.legacyPackages.${system};
|
|
goModPkgs = gomod2nix.legacyPackages.${system};
|
|
inherit (pkgs) callPackage;
|
|
});
|
|
in {
|
|
packages = eachSystem ({ goModPkgs, callPackage, ...}: {
|
|
default = callPackage ./. {
|
|
inherit (goModPkgs) buildGoApplication;
|
|
};
|
|
});
|
|
devShells = eachSystem ({goModPkgs, callPackage, ...}: {
|
|
default = callPackage ./shell.nix {
|
|
inherit (goModPkgs) mkGoEnv gomod2nix;
|
|
};
|
|
});
|
|
nixosModules.default = { config, pkgs, lib, ... }: {
|
|
options.services.bluepython508.tsnet-proxy = with lib; with types; {
|
|
clientId = mkOption {
|
|
type = str;
|
|
};
|
|
clientSecretFile = mkOption {
|
|
type = str;
|
|
};
|
|
tags = mkOption { type = listOf str; };
|
|
proxies = mkOption {
|
|
type = attrsOf (submodule ({ config }: {
|
|
options = let
|
|
proto = enum ["udp" "tcp" "unix"];
|
|
in {
|
|
enable = mkOption { type = bool; default = true; };
|
|
proto = mkOption { type = proto; };
|
|
dest = mkOption { type = str; };
|
|
hostProto = mkOption { type = proto; };
|
|
port = mkOption { type = int; };
|
|
};
|
|
config.hostProto = mkDefault config.proto;
|
|
}));
|
|
};
|
|
};
|
|
config.systemd.services = let
|
|
cfg = config.services.bluepython508.tsnet-proxy;
|
|
get-authkey = pkgs.tailscale.overrideAttrs { subPackages = ["cmd/get-authkey"]; postInstall = ""; };
|
|
in lib.mapAttrs (hostname: { proto, hostProto, port, dest, enable, ... }: {
|
|
inherit enable;
|
|
script = ''
|
|
TS_AUTHKEY=$(cat $RUNTIME_DIRECTORY/authkey) ${lib.getExe self.packages.${pkgs.system}.default} ${hostProto} ${hostname} ${port} ${proto} ${dest}
|
|
'';
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
DynamicUser = true;
|
|
RuntimeDirectory = hostname;
|
|
ExecStartPre = "!${pkgs.writeShellScript "get-authkey" ''
|
|
TS_API_CLIENT_ID=${cfg.clientId} TS_API_CLIENT_SECRET=$(cat ${cfg.clientSecretFile}) ${get-authkey}/bin/get-authkey -ephemeral -tags ${lib.concatStringsSep "," cfg.tags} > $RUNTIME_DIRECTORY/authkey
|
|
chown ${hostname}:${hostname} $RUNTIME_DIRECTORY/authkey
|
|
''}";
|
|
};
|
|
}) cfg.proxies;
|
|
};
|
|
};
|
|
}
|
|
|