feat(network): adding options for dns and search

hosts/kima/modules.nix

@@ -3,8 +3,8 @@
     boot = {
       kernel = {
         variant = "latest";
-        hardware = [ "amd" ];
-        extraKernelParams = [ ];
+        hardware = ["amd"];
+        extraKernelParams = [];
         amdOverdrive.enable = true;
       };
       loader = {
@@ -22,13 +22,20 @@
       };
       graphics = {
         enable = true;
-        vendors = [ "amd" ];
+        vendors = ["amd"];
       };
       logitech = {
         enable = true;
       };
       network = {
         enable = true;
+        nameservers = [
+          "192.168.88.1"
+          "192.168.88.69"
+        ];
+        search = [
+          "taila7448a.ts.net"
+        ];
         interfaces = {
           "eno1" = {
             allowedTCPPorts = [

hosts/sobotka/modules.nix

@@ -214,7 +214,7 @@
         flags = "--performance";
       };
       tailscale = {
-        enable = true;
+        enable = false;
       };
       udisks = {
         enable = true;

hosts/sobotka/server.nix

@@ -11,6 +11,9 @@
     traefik = {
       enable = true;
     };
+    tailscale = {
+      enable = true;
+    };
     gitea = {
       enable = true;
     };

modules/default.nix

@@ -144,6 +144,7 @@
         ./server/traefik
         ./server/www
         ./server/authentik
+        ./server/tailscale
       ];
     };
     settings = {

modules/nixos/hardware/network/default.nix

@@ -2,38 +2,47 @@
   config,
   lib,
   ...
-}:
-let
-  inherit (lib)
+}: let
+  inherit
+    (lib)
     mkIf
     mkEnableOption
     mkOption
     types
     ;
   cfg = config.nixos.hardware.network;
-in
-{
+in {
   options = {
     nixos.hardware.network = {
       enable = mkEnableOption "Enable the custom networking module";
+      nameservers = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = "The list of nameservers ";
+      };
+      search = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = "Domain search paths";
+      };
       interfaces = mkOption {
         type = types.attrsOf (
           types.submodule {
             options = {
               allowedTCPPorts = mkOption {
                 type = types.listOf types.int;
-                default = [ ];
+                default = [];
                 description = "List of allowed TCP ports for this interface.";
               };
               allowedUDPPorts = mkOption {
                 type = types.listOf types.int;
-                default = [ ];
+                default = [];
                 description = "List of allowed UDP ports for this interface.";
               };
             };
           }
         );
-        default = { };
+        default = {};
         description = "Network interface configurations.";
       };
       extraHosts = mkOption {
@@ -47,7 +56,7 @@ in
   config = mkIf cfg.enable {
     assertions = [
       {
-        assertion = cfg.interfaces != { } -> config.networking.networkmanager.enable;
+        assertion = cfg.interfaces != {} -> config.networking.networkmanager.enable;
         message = "Network interfaces configured but NetworkManager is not enabled";
       }
     ];
@@ -55,6 +64,8 @@ in
     networking = {
       networkmanager.enable = true;
       nftables.enable = true;
+      nameservers = cfg.nameservers;
+      search = cfg.search;
       firewall = {
         enable = true;
         inherit (cfg) interfaces;
@@ -63,8 +74,8 @@ in
     };
 
     systemd.services.NetworkManager = {
-      wants = [ "nftables.service" ];
-      after = [ "nftables.service" ];
+      wants = ["nftables.service"];
+      after = ["nftables.service"];
     };
   };
 }

modules/server/jellyfin/default.nix

@@ -18,7 +18,7 @@ in {
     };
     url = lib.mkOption {
       type = lib.types.str;
-      default = "jellyfin.${srv.domain}";
+      default = "sobotka.taila7448a.ts.net";
     };
     homepage.name = lib.mkOption {
       type = lib.types.str;
@@ -53,9 +53,9 @@ in {
           routers = {
             jellyfinRouter = {
               entryPoints = ["websecure"];
-              rule = "Host(`fin.${srv.www.url}`)";
+              rule = "Host(`${cfg.url}`)";
               service = "${unit}";
-              tls.certResolver = "tailscale";
+              tls.certResolver = "vpn";
             };
           };
         };

modules/server/tailscale/default.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  self,
+  ...
+}:
+with lib; let
+  cfg = config.server.tailscale;
+in {
+  options.server.tailscale = {
+    enable = mkEnableOption "Enable tailscale server configuration";
+  };
+
+  config = mkIf cfg.enable {
+    age.secrets.sobotkaTsAuth.file = "${self}/secrets/sobotkaTsAuth.age";
+
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      useRoutingFeatures = "server";
+      authKeyFile = config.age.secrets.sobotkaTsAuth.path;
+      extraSetFlags = [
+        "--advertise-exit-node"
+        "--advertise-routes=192.168.88.0/24"
+      ];
+    };
+  };
+}

modules/server/traefik/default.nix

@@ -49,7 +49,7 @@ in {
             dashboard = true;
           };
           certificatesResolvers = {
-            tailscale.tailscale = {};
+            vpn.tailscale = {};
             letsencrypt = {
               acme = {
                 email = "adam@cnst.dev";

secrets/secrets.nix

@@ -61,6 +61,7 @@ in {
   "traefikEnv.age".publicKeys = kima ++ sobotka;
   "wwwCloudflared.age".publicKeys = kima ++ sobotka;
   "authentikCloudflared.age".publicKeys = kima ++ sobotka;
+  "sobotkaTsAuth.age".publicKeys = kima ++ sobotka;
 
   # Ziggy-specific
   "cloudflareDnsCredentialsZiggy.age".publicKeys = kima ++ ziggy;

secrets/sobotkaTsAuth.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 t9iOEg fftdt8orBZoM0sDRAXf0TScDLosNWWWIg7JmmuunuWM
+2IfpTH6ptSyLnBtBStkk7SINct6LtBHrL6h22BVNb+k
+-> ssh-ed25519 KUYMFA HI04mnVOGPRsRhnqCkbO4My/sBq5v/3UYxDVcfIe4RM
+fcSApUYCnJlpzVW5e77CFoSHamEmP+6ztMmzp2WlJvY
+-> ssh-ed25519 76RhUQ c2FbmTXGl/F+1acZFEJUoenkxiIGdoXkT67VgxvoFHg
+eWExqblEp5VIeXuPEuvj4QAIWtFX5KLfMyh6/fZ9bnA
+-> ssh-ed25519 Jf8sqw IAcUf70EufTyjsva8XIlXOfPxwXvtr9AFl0LwrdAMgc
+bY098fejLaFbUMX0iF89gz8kiOGZHI8JIg4NzX4ItFw
+--- WNqpLyRM2EqISbZky++NbKLw4GCEgwbz2O5+VO7aKzE
+<EFBFBD><EFBFBD><1A><>(5<0F>q	<09><>m<EFBFBD>C<EFBFBD><43>G<EFBFBD>r<><72><16><><EFBFBD><EFBFBD>ޒ3<DE92><33><17><1F>7<><37><EFBFBD>rG<72>i<EFBFBD>c7<63>i<EFBFBD>P<EFBFBD><50>l<EFBFBD><19>7<EFBFBD><<3C>r?cGo<47>^ǚ<>W<0E>V<EFBFBD><56>f,2<>Qg!<21>t_<74>