tjh.dev
nixpkgs mirror (for testing)
github.com/NixOS/nixpkgs
nix
1{ pkgs, lib, ... }:
2let
3 tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
4 openssl req \
5 -x509 -newkey rsa:4096 -sha256 -days 365 \
6 -nodes -out cert.pem -keyout key.pem \
7 -subj '/CN=headscale' -addext "subjectAltName=DNS:headscale"
8
9 mkdir -p $out
10 cp key.pem cert.pem $out
11 '';
12in
13{
14 name = "headscale";
15 meta.maintainers = with lib.maintainers; [
16 kradalby
17 misterio77
18 ];
19
20 nodes =
21 let
22 headscalePort = 8080;
23 stunPort = 3478;
24 peer = {
25 services.tailscale.enable = true;
26 security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
27 };
28 in
29 {
30 peer1 = peer;
31 peer2 = peer;
32
33 headscale = {
34 services = {
35 headscale = {
36 enable = true;
37 port = headscalePort;
38 settings = {
39 server_url = "https://headscale";
40 ip_prefixes = [ "100.64.0.0/10" ];
41 derp.server = {
42 enabled = true;
43 region_id = 999;
44 stun_listen_addr = "0.0.0.0:${toString stunPort}";
45 };
46 dns = {
47 base_domain = "tailnet";
48 override_local_dns = false;
49 };
50 };
51 };
52 nginx = {
53 enable = true;
54 virtualHosts.headscale = {
55 addSSL = true;
56 sslCertificate = "${tls-cert}/cert.pem";
57 sslCertificateKey = "${tls-cert}/key.pem";
58 locations."/" = {
59 proxyPass = "http://127.0.0.1:${toString headscalePort}";
60 proxyWebsockets = true;
61 };
62 };
63 };
64 };
65 networking.firewall = {
66 allowedTCPPorts = [
67 80
68 443
69 ];
70 allowedUDPPorts = [ stunPort ];
71 };
72 environment.systemPackages = [ pkgs.headscale ];
73 };
74 };
75
76 testScript = ''
77 start_all()
78 headscale.wait_for_unit("headscale")
79 headscale.wait_for_open_port(443)
80
81 # Create headscale user and preauth-key
82 headscale.succeed("headscale users create test")
83 authkey = headscale.succeed("headscale preauthkeys -u 1 create --reusable")
84
85 # Connect peers
86 up_cmd = f"tailscale up --login-server 'https://headscale' --auth-key {authkey}"
87 peer1.execute(up_cmd)
88 peer2.execute(up_cmd)
89
90 # Check that they are reachable from the tailnet
91 peer1.wait_until_succeeds("tailscale ping peer2")
92 peer2.wait_until_succeeds("tailscale ping peer1.tailnet")
93 '';
94}