1{
 2  den.aspects.services.headscale.dns = {
 3    nixos = {
 4      host,
 5      reverseProxy,
 6      lib,
 7      config,
 8      ...
 9    }: let
10      inherit (import ./_lib.nix {inherit lib;}) dnsRecordsFilePath mkDirectEntries;
11
12      cfg = host.settings.services.headscale;
13
14      directEntries = mkDirectEntries reverseProxy;
15
16      mkRecordValue = ip:
17        if ip.kind == "clear"
18        then ip.value
19        else config.vaultix.placeholder.${ip.name};
20
21      directRecords = lib.concatMap (e:
22        lib.optionals (e.v4 != null) [
23          {
24            name = e.domain;
25            type = "A";
26            value = mkRecordValue e.v4;
27          }
28        ]
29        ++ lib.optionals (e.v6 != null) [
30          {
31            name = e.domain;
32            type = "AAAA";
33            value = mkRecordValue e.v6;
34          }
35        ])
36      directEntries;
37
38      directSecretIps = lib.unique (lib.concatMap (e:
39        lib.optional (e.v4 != null && e.v4.kind == "secret") e.v4
40        ++ lib.optional (e.v6 != null && e.v6.kind == "secret") e.v6)
41      directEntries);
42    in {
43      services.headscale.settings.dns = {
44        magic_dns = cfg.dns.enable;
45        override_local_dns = cfg.dns.enable;
46        base_domain = cfg.dns.domain;
47        nameservers.global = [
48          # IPv4
49          "119.29.29.29" # DNSPod
50          "223.5.5.5" # AliDNS
51          # IPv6
52          "2400:3200::1" # AliDNS
53          "2606:4700:4700::1111" # Cloudflare
54        ];
55        extra_records_path = dnsRecordsFilePath;
56      };
57
58      vaultix.secrets = lib.listToAttrs (map (s: {
59          name = s.name;
60          value.file = s.file;
61        })
62        directSecretIps);
63
64      vaultix.templates.headscale-direct-records = {
65        content = builtins.toJSON directRecords;
66        owner = config.services.headscale.user;
67        group = config.services.headscale.group;
68        mode = "0400";
69      };
70    };
71  };
72}