From 2fb1a1bec8af7019623f24e0d799265d53736ff0 Mon Sep 17 00:00:00 2001
From: Fabian Hauser <fabian@fh2.ch>
Date: Fri, 6 Dec 2024 19:08:11 +0200
Subject: [PATCH] Update headscale configuration

---
 defaults/meta/network-virtual.nix         |   2 +-
 nixos-modules/qois/vpn-server/default.nix | 123 ++++++++++++----------
 2 files changed, 69 insertions(+), 56 deletions(-)

diff --git a/defaults/meta/network-virtual.nix b/defaults/meta/network-virtual.nix
index 6e1fdad..4cf70d1 100644
--- a/defaults/meta/network-virtual.nix
+++ b/defaults/meta/network-virtual.nix
@@ -15,7 +15,7 @@
           id = "100.64.0.0";
           prefixLength = 10;
         };
-        domain = "vpn.qo.is";
+        domain = "vpn.net.qo.is";
         hosts = { };
       };
 
diff --git a/nixos-modules/qois/vpn-server/default.nix b/nixos-modules/qois/vpn-server/default.nix
index 5940292..b3e5e92 100644
--- a/nixos-modules/qois/vpn-server/default.nix
+++ b/nixos-modules/qois/vpn-server/default.nix
@@ -16,6 +16,11 @@ in
 
   options.qois.vpn-server = {
     enable = mkEnableOption "Enable vpn server services";
+    domain = mkOption {
+      description = "Domain for the VPN admin server";
+      type = types.str;
+      default = "vpn.qo.is";
+    };
     dnsRecords = mkOption {
       description = "DNS records to add to Hosts";
       type = with types; attrsOf str;
@@ -36,8 +41,8 @@ in
       with config.services.headscale.settings;
       (
         [
-          db_path
-          private_key_path
+          database.sqlite.path
+          derp.server.private_key_path
           noise.private_key_path
         ]
         ++ derp.paths
@@ -56,22 +61,22 @@ in
       in
       {
         enable = true;
-        address = vnet.backplane.hosts.cyprianspitz.v4.ip;
+        address = vnet.backplane.hosts.cyprianspitz.v4.ip; # TODO: This entails that the backplane interface is up.
         port = 46084;
         settings = {
-          server_url = "https://${vpnNet.domain}:443";
+          server_url = "https://${cfg.domain}:443";
 
           tls_letsencrypt_challenge_type = "TLS-ALPN-01";
           tls_letsencrypt_hostname = vpnNet.domain;
 
-          dns_config = {
-            nameservers = [ vnet.backplane.hosts.calanda.v4.ip ];
-            domains = [
-              vpnNet.domain
+          dns = {
+            base_domain = vpnNet.domain;
+            magic_dns = true;
+            nameservers.global = [ vnet.backplane.hosts.calanda.v4.ip ];
+            search_domains = [
+              # vpnNet.domain # First by default with magic_dns
               vnet.backplane.domain
             ];
-            magic_dns = true;
-            base_domain = vpnNet.domain;
             extra_records = pipe cfg.dnsRecords [
               attrsToList
               (map (val: val // { type = "A"; }))
@@ -80,56 +85,64 @@ in
 
           ip_prefixes = [ vpnNetPrefix ];
 
-          acl_policy_path = pkgs.writeTextFile {
-            name = "acls";
-            text = builtins.toJSON {
-              hosts = {
-                "clients" = vpnNetPrefix;
-              };
-              groups = {
-                "group:wheel" = cfg.wheelUsers;
-              };
-              tagOwners = {
-                "tag:srv" = [ "srv" ]; # srv tag ist owned by srv user
-              };
-              autoApprovers = {
-                exitNode = [
-                  "tag:srv"
-                  "group:wheel"
-                ];
-                routes = {
-                  ${backplaneNetPrefix} = [ "tag:srv" ];
+          policy =
+            let
+              # Note: headscale has limited acl support currently. This might change in the future.
+              aclPolicy = {
+                hosts = {
+                  "clients" = vpnNetPrefix;
                 };
-              };
-
-              acls = [
-                # Allow all communication from and to srv tagged hosts
-                {
-                  action = "accept";
-                  src = [
+                groups = {
+                  "group:wheel" = cfg.wheelUsers;
+                };
+                tagOwners = {
+                  "tag:srv" = [ "srv" ]; # srv tag ist owned by srv user
+                };
+                autoApprovers = {
+                  exitNode = [
                     "tag:srv"
-                    "srv"
+                    "group:wheel"
                   ];
-                  dst = [ "*:*" ];
-                }
-                {
-                  action = "accept";
-                  src = [ "*" ];
-                  dst = [
-                    "tag:srv:*"
-                    "srv:*"
-                  ];
-                }
+                  routes = {
+                    ${backplaneNetPrefix} = [ "tag:srv" ];
+                  };
+                };
 
-                # Allow access to all connected hosts for wheels
-                {
-                  action = "accept";
-                  src = [ "group:wheel" ];
-                  dst = [ "*:*" ];
-                }
-              ];
+                acls = [
+                  # Allow all communication from and to srv tagged hosts
+                  {
+                    action = "accept";
+                    src = [
+                      "tag:srv"
+                      "srv"
+                    ];
+                    dst = [ "*:*" ];
+                  }
+                  {
+                    action = "accept";
+                    src = [ "*" ];
+                    dst = [
+                      "tag:srv:*"
+                      "srv:*"
+                    ];
+                  }
+
+                  # Allow access to all connected hosts for wheels
+                  {
+                    action = "accept";
+                    src = [ "group:wheel" ];
+                    dst = [ "*:*" ];
+                  }
+                ];
+              };
+            in
+            {
+              mode = "file";
+              path = pkgs.writeTextFile {
+                name = "acls";
+                text = builtins.toJSON aclPolicy;
+              };
             };
-          };
         };
       };
   });