Marcus (agent-cos)
7b5ffe6b11
- Multi-host flake.nix (3x N97 x86_64 + 2x RPi4 aarch64) - Shared modules: k3s-cluster, tailscale, meos-gateway - Node configs: n97-1 (control plane), n97-2/n97-3 (Ollama workers), rpi4-1/rpi4-2 (ARM workers) - K8s manifests: Forgejo, Postgres (CNPG), Umami, OpenBrain, MeOS Dashboard, MCP servers - Bootstrap and DB migration scripts - Migration plan doc (7-day phased rollout)
34 lines
888 B
Nix
34 lines
888 B
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.services.tailscale-node;
|
|
in {
|
|
options.services.tailscale-node = {
|
|
enable = mkEnableOption "Tailscale mesh node";
|
|
authKeyFile = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = "Path to file containing Tailscale pre-auth key (for unattended setup).";
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
services.tailscale = {
|
|
enable = true;
|
|
interfaceName = "tailscale0";
|
|
authKeyFile = cfg.authKeyFile;
|
|
extraUpFlags = "--accept-routes --accept-dns=false";
|
|
};
|
|
|
|
# Persist Tailscale state across reboots
|
|
systemd.services.tailscale = {
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
serviceConfig.SupplementaryGroups = [ "nginx" ];
|
|
};
|
|
|
|
networking.firewall.trustedInterfaces = [ "tailscale0" ];
|
|
};
|
|
}
|