feat(network): adding options for dns and search

modules/default.nix

@@ -144,6 +144,7 @@
         ./server/traefik
         ./server/www
         ./server/authentik
+        ./server/tailscale
       ];
     };
     settings = {

modules/nixos/hardware/network/default.nix

@@ -2,38 +2,47 @@
   config,
   lib,
   ...
-}:
-let
-  inherit (lib)
+}: let
+  inherit
+    (lib)
     mkIf
     mkEnableOption
     mkOption
     types
     ;
   cfg = config.nixos.hardware.network;
-in
-{
+in {
   options = {
     nixos.hardware.network = {
       enable = mkEnableOption "Enable the custom networking module";
+      nameservers = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = "The list of nameservers ";
+      };
+      search = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = "Domain search paths";
+      };
       interfaces = mkOption {
         type = types.attrsOf (
           types.submodule {
             options = {
               allowedTCPPorts = mkOption {
                 type = types.listOf types.int;
-                default = [ ];
+                default = [];
                 description = "List of allowed TCP ports for this interface.";
               };
               allowedUDPPorts = mkOption {
                 type = types.listOf types.int;
-                default = [ ];
+                default = [];
                 description = "List of allowed UDP ports for this interface.";
               };
             };
           }
         );
-        default = { };
+        default = {};
         description = "Network interface configurations.";
       };
       extraHosts = mkOption {
@@ -47,7 +56,7 @@ in
   config = mkIf cfg.enable {
     assertions = [
       {
-        assertion = cfg.interfaces != { } -> config.networking.networkmanager.enable;
+        assertion = cfg.interfaces != {} -> config.networking.networkmanager.enable;
         message = "Network interfaces configured but NetworkManager is not enabled";
       }
     ];
@@ -55,6 +64,8 @@ in
     networking = {
       networkmanager.enable = true;
       nftables.enable = true;
+      nameservers = cfg.nameservers;
+      search = cfg.search;
       firewall = {
         enable = true;
         inherit (cfg) interfaces;
@@ -63,8 +74,8 @@ in
     };
 
     systemd.services.NetworkManager = {
-      wants = [ "nftables.service" ];
-      after = [ "nftables.service" ];
+      wants = ["nftables.service"];
+      after = ["nftables.service"];
     };
   };
 }

modules/server/jellyfin/default.nix

@@ -18,7 +18,7 @@ in {
     };
     url = lib.mkOption {
       type = lib.types.str;
-      default = "jellyfin.${srv.domain}";
+      default = "sobotka.taila7448a.ts.net";
     };
     homepage.name = lib.mkOption {
       type = lib.types.str;
@@ -53,9 +53,9 @@ in {
           routers = {
             jellyfinRouter = {
               entryPoints = ["websecure"];
-              rule = "Host(`fin.${srv.www.url}`)";
+              rule = "Host(`${cfg.url}`)";
               service = "${unit}";
-              tls.certResolver = "tailscale";
+              tls.certResolver = "vpn";
             };
           };
         };

modules/server/tailscale/default.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  self,
+  ...
+}:
+with lib; let
+  cfg = config.server.tailscale;
+in {
+  options.server.tailscale = {
+    enable = mkEnableOption "Enable tailscale server configuration";
+  };
+
+  config = mkIf cfg.enable {
+    age.secrets.sobotkaTsAuth.file = "${self}/secrets/sobotkaTsAuth.age";
+
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      useRoutingFeatures = "server";
+      authKeyFile = config.age.secrets.sobotkaTsAuth.path;
+      extraSetFlags = [
+        "--advertise-exit-node"
+        "--advertise-routes=192.168.88.0/24"
+      ];
+    };
+  };
+}

modules/server/traefik/default.nix

@@ -49,7 +49,7 @@ in {
             dashboard = true;
           };
           certificatesResolvers = {
-            tailscale.tailscale = {};
+            vpn.tailscale = {};
             letsencrypt = {
               acme = {
                 email = "adam@cnst.dev";