Move all nixos-modules out of qois subfolder

nixos-modules/vpn-server/default.nix

@@ -0,0 +1,157 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+with lib;
+let
+  cfg = config.qois.vpn-server;
+  cfgLoadbalancer = config.qois.loadbalancer;
+  defaultDnsRecords =
+    (mapAttrs (
+      name: value: mkIf (cfgLoadbalancer.hostmap ? ${value}) cfgLoadbalancer.hostmap.${value}
+    ) cfgLoadbalancer.domains)
+    // {
+      "vpn.qo.is" = config.services.headscale.address;
+    };
+in
+{
+
+  options.qois.vpn-server = {
+    enable = mkEnableOption "Enable vpn server services";
+    domain = mkOption {
+      description = "Domain for the VPN admin server";
+      type = types.str;
+      default = "vpn.qo.is";
+    };
+    dnsRecords = mkOption {
+      description = "DNS records to add to Hosts";
+      type = with types; attrsOf str;
+      default = defaultDnsRecords;
+    };
+    wheelUsers = mkOption {
+      description = "Usernames that can change configurations";
+      type = with types; listOf str;
+      default = [ ];
+    };
+  };
+
+  config = mkIf cfg.enable ({
+
+    environment.systemPackages = [ pkgs.headscale ];
+
+    # We bind to the backplane vpn IP, so wait for the wireguard net to be available
+    systemd.services.headscale.after = [ "wireguard-wg-backplane.service" ];
+
+    qois.backup-client.includePaths =
+      with config.services.headscale.settings;
+      (
+        [
+          database.sqlite.path
+          derp.server.private_key_path
+          noise.private_key_path
+        ]
+        ++ derp.paths
+      );
+
+    networking.firewall.checkReversePath = "loose";
+    networking.firewall.allowedTCPPorts = [ config.services.headscale.port ];
+    networking.firewall.allowedUDPPorts = [
+      41641
+    ];
+    services.headscale =
+      let
+        vnet = config.qois.meta.network.virtual;
+        vpnNet = vnet.vpn;
+        vpnNetPrefix = "${vpnNet.v4.id}/${toString vpnNet.v4.prefixLength}";
+        backplaneNetPrefix = "${vnet.backplane.v4.id}/${builtins.toString vnet.backplane.v4.prefixLength}";
+      in
+      {
+        enable = true;
+        address = vnet.backplane.hosts.cyprianspitz.v4.ip;
+        port = 46084;
+        settings = {
+          server_url = "https://${cfg.domain}:443";
+
+          tls_letsencrypt_challenge_type = "TLS-ALPN-01";
+          tls_letsencrypt_hostname = vpnNet.domain;
+
+          dns = {
+            base_domain = vpnNet.domain;
+            magic_dns = true;
+            nameservers.global = [ "127.0.0.1" ];
+            search_domains = [
+              # First is base_domain by default with magic_dns
+              vnet.backplane.domain
+            ];
+            extra_records = pipe cfg.dnsRecords [
+              attrsToList
+              (map (val: val // { type = "A"; }))
+            ];
+          };
+
+          ip_prefixes = [ vpnNetPrefix ];
+
+          policy =
+            let
+              # Note: headscale has limited acl support currently. This might change in the future.
+              aclPolicy = {
+                hosts = {
+                  "clients" = vpnNetPrefix;
+                };
+                groups = {
+                  "group:wheel" = cfg.wheelUsers;
+                };
+                tagOwners = {
+                  "tag:srv" = [ "srv" ]; # srv tag ist owned by srv user
+                };
+                autoApprovers = {
+                  exitNode = [
+                    "tag:srv"
+                    "group:wheel"
+                  ];
+                  routes = {
+                    ${backplaneNetPrefix} = [ "tag:srv" ];
+                  };
+                };
+
+                acls = [
+                  # Allow all communication from and to srv tagged hosts
+                  {
+                    action = "accept";
+                    src = [
+                      "tag:srv"
+                      "srv"
+                    ];
+                    dst = [ "*:*" ];
+                  }
+                  {
+                    action = "accept";
+                    src = [ "*" ];
+                    dst = [
+                      "tag:srv:*"
+                      "srv:*"
+                    ];
+                  }
+
+                  # Allow access to all connected hosts for wheels
+                  {
+                    action = "accept";
+                    src = [ "group:wheel" ];
+                    dst = [ "*:*" ];
+                  }
+                ];
+              };
+            in
+            {
+              mode = "file";
+              path = pkgs.writeTextFile {
+                name = "acls";
+                text = builtins.toJSON aclPolicy;
+              };
+            };
+        };
+      };
+  });
+}