Extract vpn exit node config to module

nixos-modules/qois/loadbalancer/default.nix

@@ -79,7 +79,7 @@ let
 in
 {
 
-  options.qois.loadbalancer = with lib; {
+  options.qois.loadbalancer = {
     enable = mkEnableOption "Enable services http+s loadbalancing";
 
     domains = mkOption {

nixos-modules/qois/vpn-exit-node/default.nix

@@ -0,0 +1,50 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+with lib;
+let
+  cfg = config.qois.vpn-exit-node;
+in
+{
+
+  options.qois.vpn-exit-node = {
+    enable = mkEnableOption "vpn exit node";
+    domain = mkOption {
+      description = "Domain for the VPN admin server";
+      type = types.str;
+      default = "vpn.qo.is";
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    qois.backup-client.includePaths = [ "/var/lib/tailscale" ];
+
+    sops.secrets."tailscale/key".restartUnits = [ "tailscaled.service" ];
+
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      useRoutingFeatures = "server";
+      authKeyFile = config.sops.secrets."tailscale/key".path;
+      extraUpFlags =
+        let
+          backplaneRoute =
+            with config.qois.meta.network.virtual.backplane.v4;
+            "${id}/${builtins.toString prefixLength}";
+        in
+        [
+          "--timeout 60s"
+          "--accept-dns=false"
+          "--accept-routes=false"
+          "--login-server=https://${cfg.domain}"
+          "--advertise-exit-node"
+          "--advertise-routes=${backplaneRoute}"
+          "--advertise-tags=tag:srv"
+        ];
+    };
+  };
+}

nixos-modules/qois/vpn-server/default.nix

@@ -56,6 +56,7 @@ in
       );
 
     networking.firewall.checkReversePath = "loose";
+    networking.firewall.allowedTCPPorts = [ config.services.headscale.port ];
     networking.firewall.allowedUDPPorts = [
       41641
     ];