dotfiles/nixos/boxes/bolty/tailscale-cert.nix

64 lines
1.5 KiB
Nix
Raw Normal View History

2023-08-13 17:00:41 +01:00
{
config,
pkgs,
inputs,
lib,
...
}: let
2023-02-26 12:05:55 +00:00
fqdn = "bolty.raptor-carp.ts.net";
basePath = "/var/lib/tailscale-certs";
keyPath = "${basePath}/key.pem";
certPath = "${basePath}/cert.pem";
in {
2023-08-13 17:00:41 +01:00
imports = [];
2023-02-26 12:05:55 +00:00
2024-04-27 11:33:38 +01:00
systemd.services = {
tailscale-cert-make-path = {
script = ''
mkdir -p ${basePath}
'';
serviceConfig = {Type = "oneshot";};
before = ["tailscale-cert.service"];
wantedBy = ["multi-user.target"];
};
2023-02-26 12:05:55 +00:00
2024-04-27 11:33:38 +01:00
tailscale-cert = {
after = ["network.target" "network-online.target" "tailscaled.service"];
wants = ["tailscaled.service"];
wantedBy = ["multi-user.target"];
2023-02-26 12:05:55 +00:00
2024-04-27 11:33:38 +01:00
path = with pkgs; [tailscale];
2023-02-26 12:05:55 +00:00
2024-04-27 11:33:38 +01:00
serviceConfig = {
Type = "oneshot";
UMask = 22;
StateDirectoryMode = 750;
ProtectSystem = "strict";
ReadWritePaths = ["${basePath}"];
PrivateTmp = true;
WorkingDirectory = "${basePath}";
NoNewPrivileges = true;
PrivateDevices = true;
ProtectClock = true;
ProtectHome = true;
ProtectHostname = true;
StateDirectory = ["${basePath}"];
};
2023-02-26 12:05:55 +00:00
2024-04-27 11:33:38 +01:00
script = ''
tailscale cert --cert-file ${certPath} --key-file ${keyPath} ${fqdn}
'';
};
2023-02-26 12:05:55 +00:00
};
systemd.timers.tailscale-renew = {
2023-08-13 17:00:41 +01:00
wantedBy = ["timers.target"];
2023-02-26 12:05:55 +00:00
description = "Renew tailscale server cert";
timerConfig = {
OnCalendar = "weekly";
Unit = "tailscale-cert.service";
Persistent = "yes";
RandomizedDelaySec = "24h";
};
};
}