From c5d9d01f84ba5ca27066d63d24b6cbed123cbce5 Mon Sep 17 00:00:00 2001
From: Fabian Hauser <fabian@fh2.ch>
Date: Wed, 11 Dec 2024 13:11:42 +0200
Subject: [PATCH] Extract vpn exit node config to module

---
 .../cyprianspitz/networking.nix               | 19 +------
 nixos-configurations/cyprianspitz/secrets.nix |  3 --
 nixos-configurations/lindberg/networking.nix  | 19 +------
 nixos-modules/qois/vpn-exit-node/default.nix  | 49 +++++++++++++++++++
 4 files changed, 52 insertions(+), 38 deletions(-)
 create mode 100644 nixos-modules/qois/vpn-exit-node/default.nix

diff --git a/nixos-configurations/cyprianspitz/networking.nix b/nixos-configurations/cyprianspitz/networking.nix
index de8132d..3649afb 100644
--- a/nixos-configurations/cyprianspitz/networking.nix
+++ b/nixos-configurations/cyprianspitz/networking.nix
@@ -78,22 +78,5 @@ in
   qois.backplane-net.enable = true;
 
   # Configure this node to be used as an vpn exit node
-  qois.backup-client.includePaths = [ "/var/lib/tailscale" ];
-  services.tailscale = {
-    enable = true;
-    openFirewall = true;
-    useRoutingFeatures = "server";
-    authKeyFile = config.sops.secrets."tailscale/key".path;
-    extraUpFlags = [
-      "--timeout 60s"
-      "--accept-dns=false"
-      "--login-server=https://vpn.qo.is"
-      "--advertise-exit-node"
-      (
-        with meta.network.virtual.backplane.v4; "--advertise-routes=${id}/${builtins.toString prefixLength}"
-      )
-      "--advertise-tags=tag:srv"
-    ];
-  };
-
+  qois.vpn-exit-node.enable = true;
 }
diff --git a/nixos-configurations/cyprianspitz/secrets.nix b/nixos-configurations/cyprianspitz/secrets.nix
index 0e9f62c..d61753f 100644
--- a/nixos-configurations/cyprianspitz/secrets.nix
+++ b/nixos-configurations/cyprianspitz/secrets.nix
@@ -3,8 +3,5 @@
   sops.secrets = {
     "system/hdd" = { };
     "system/initrd-ssh-key" = { };
-    "tailscale/key" = {
-      restartUnits = [ "tailscaled.service" ];
-    };
   };
 }
diff --git a/nixos-configurations/lindberg/networking.nix b/nixos-configurations/lindberg/networking.nix
index 50c631c..35218f7 100644
--- a/nixos-configurations/lindberg/networking.nix
+++ b/nixos-configurations/lindberg/networking.nix
@@ -38,7 +38,7 @@ in
     in
     {
       enable = true;
-      resolveLocalQueries = false;
+      resolveLocalQueries = true;
       settings = {
         interface = "vms-nat";
         bind-interfaces = true;
@@ -74,20 +74,5 @@ in
 
   qois.backplane-net.enable = true;
 
-  # Use this node as vpn exit node
-  qois.backup-client.includePaths = [ "/var/lib/tailscale" ];
-  services.tailscale = {
-    enable = true;
-    openFirewall = true;
-    useRoutingFeatures = "server";
-    authKeyFile = config.sops.secrets."tailscale/key".path;
-    extraUpFlags = [
-      "--login-server=https://vpn.qo.is"
-      "--advertise-exit-node"
-      (
-        with meta.network.virtual.backplane.v4; "--advertise-routes=${id}/${builtins.toString prefixLength}"
-      )
-      "--advertise-tags=tag:srv"
-    ];
-  };
+  qois.vpn-exit-node.enable = true;
 }
diff --git a/nixos-modules/qois/vpn-exit-node/default.nix b/nixos-modules/qois/vpn-exit-node/default.nix
new file mode 100644
index 0000000..cc5dc82
--- /dev/null
+++ b/nixos-modules/qois/vpn-exit-node/default.nix
@@ -0,0 +1,49 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+with lib;
+let
+  cfg = config.qois.vpn-exit-node;
+in
+{
+
+  options.qois.vpn-exit-node = {
+    enable = mkEnableOption "vpn exit node";
+    domain = mkOption {
+      description = "Domain for the VPN admin server";
+      type = types.str;
+      default = "vpn.qo.is";
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    qois.backup-client.includePaths = [ "/var/lib/tailscale" ];
+
+    sops.secrets."tailscale/key".restartUnits = [ "tailscaled.service" ];
+
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      useRoutingFeatures = "server";
+      authKeyFile = config.sops.secrets."tailscale/key".path;
+      extraUpFlags =
+        let
+          backplaneRoute =
+            with config.qois.meta.network.virtual.backplane.v4;
+            "${id}/${builtins.toString prefixLength}";
+        in
+        [
+          "--timeout 60s"
+          "--accept-dns=false"
+          "--login-server=https://${cfg.domain}"
+          "--advertise-exit-node"
+          "--advertise-routes=${backplaneRoute}"
+          "--advertise-tags=tag:srv"
+        ];
+    };
+  };
+}