101 lines
3.2 KiB
Markdown
101 lines
3.2 KiB
Markdown
# VPN
|
|
|
|
We run a [Tailscale](https://tailscale.com) compatible VPN service on [vpn.qo.is](https://vpn.qo.is).
|
|
|
|
## User and Client Management
|
|
|
|
To register a new client on the `vpn.qo.is` host:, generate a pre-auth key and insert it in the client:
|
|
|
|
```bash
|
|
headscale users create marlene.mayer
|
|
headscale preauthkeys create --user marlene.mayer
|
|
```
|
|
|
|
> ⚠️ For now, the username must be added to `qois.vpn-server.wheelUsers`.
|
|
> In the future, the VPN ACL might get more granular to allow for non-wheel users.
|
|
|
|
Alternatively to using a pre-auth key, the register command shown when configuring the VPN client may be used.
|
|
|
|
## ACL
|
|
|
|
At this time, there are a few ACL rules to isolate a users host but do not expect them to be expected to be enforced - expect your client to be accessible by the whole network.
|
|
|
|
## Exit Nodes
|
|
|
|
These nodes allow access to the internet for clients connected to the VPN:
|
|
|
|
- `100.64.0.5`: lindberg (riedbach-net)
|
|
- `100.64.0.6`: cyprianspitz (plessur-net)
|
|
|
|
> ⚠️ Currently, name resolution for these do not work reliably on first starts, hence the IP must be used. This hould be fixed in the future.
|
|
|
|
### Add exit nodes:
|
|
|
|
1. Create a preauth secret on the `vpn.qo.is` host:
|
|
```bash
|
|
headscale preauthkeys create --user srv --reusable
|
|
```
|
|
1. Configure the new exit-node host with the `qois.vpn-exit-node` module.
|
|
|
|
When using the `srv` user, exit nodes and routes are automatically accepted as trusted.
|
|
|
|
## Clients
|
|
|
|
To use the service, you can use a normal Tailscale client with following additional configuration:
|
|
|
|
| Option | Recommended value | Description |
|
|
|--------|-------------------|-------------|
|
|
| `accept-routes` | enabled (flag) | Accept direct routes to internal services |
|
|
| `exit-node` | `100.64.0.5` (lindberg) or `100.64.0.6` (cypriaspitz) | Use host as [exit node](#exit-nodes) |
|
|
| `login-server` | `https://vpn.qo.is` | Use our own VPN service. |
|
|
|
|
> ⚠️ Currently, if the client is in an IPv6 network, the transport is broken.
|
|
> Disable IPv6 connectivity to use the VPN.
|
|
> See [#4](https://git.qo.is/qo.is/infrastructure/issues/4) for details.
|
|
|
|
### NixOS
|
|
|
|
Sample config with automatic connectivity to VPN on boot:
|
|
|
|
```nix
|
|
{ config, pkgs, ... }: {
|
|
services.tailscale = {
|
|
enable = true;
|
|
openFirewall = true;
|
|
useRoutingFeatures = "client";
|
|
authKeyFile = "/secrets/wireguard/tailscale-key"; # This is the pre-auth secret. Make sure it's only accessible by root.
|
|
extraUpFlags = [
|
|
"--operator"
|
|
"yourUserNameChangePlease"
|
|
"--accept-routes"
|
|
"--exit-node=100.64.0.5"
|
|
"--login-server=https://vpn.qo.is"
|
|
];
|
|
};
|
|
}
|
|
```
|
|
|
|
### Android
|
|
|
|
See [this Headscale documentation for more](https://headscale.net/stable/usage/connect/android/) on how to configure the mobile app.
|
|
|
|
> ⚠️ Note that on restarts, sometimes you have to reopen/save the config dialog.
|
|
> If the Tailscale login site is shown, just close the browser with the ❌.
|
|
|
|
## Backup and Restore
|
|
|
|
### Server
|
|
|
|
1. `systemctl stop headscale`
|
|
1. Replace `/var/lib/headscale`
|
|
1. `systemctl start headscale`
|
|
1. Monitor logs for errors
|
|
|
|
Note: `/var/lib/headscale` contains a sqlite database.
|
|
|
|
### Clients
|
|
|
|
1. `systemctl stop tailscaled`
|
|
1. Replace `/var/lib/tailscale`
|
|
1. `systemctl start tailscaled`
|
|
1. Monitor logs for errors
|