Commit 1880494

@@ -52,14 +52,18 @@
     nixos = {host, ...}: {
       services.openssh = {
         enable = true;
-        ports = [host.settings.core.openssh.access.port];
+        # Serve on 22 port for Tailscale
+        ports = lib.unique [22 host.settings.core.openssh.access.port];
         settings = {
           PermitRootLogin = "prohibit-password";
           PasswordAuthentication = false;
         };
-        openFirewall = true;
+        # Mannualy open filewall
+        openFirewall = false;
       };
 
+      networking.firewall.allowedTCPPorts = [host.settings.core.openssh.access.port];
+
       environment.enableAllTerminfo = true;
     };
   };

@@ -0,0 +1,36 @@
+{
+  den.aspects.core.tailscale = {
+    persist = {
+      directories = [
+        {
+          directory = "/var/lib/tailscale";
+          mode = "0700";
+        }
+      ];
+    };
+
+    nixos = {
+      config,
+      pkgs,
+      ...
+    }: {
+      environment.systemPackages = [pkgs.tailscale];
+
+      services.tailscale = {
+        enable = true;
+        extraUpFlags = [
+          "--login-server=https://gate.trin.one"
+          "--accept-dns=true"
+        ];
+      };
+
+      networking.firewall = {
+        trustedInterfaces = [config.services.tailscale.interfaceName];
+        allowedUDPPorts = [config.services.tailscale.port];
+      };
+
+      systemd.network.wait-online.enable = false;
+      boot.initrd.systemd.network.wait-online.enable = false;
+    };
+  };
+}

@@ -5,6 +5,8 @@
         name = "host-ipv4-hyacine";
         file = ./ipv4.age;
       };
+      ipv4.tailscale = "100.127.6.231";
+      ipv6.tailscale = "fd7a:115c:a1e0:675d:6820:4fa0:fddc:a59";
     };
   };
 

@@ -1,4 +1,11 @@
 {
+  den.hosts.kevin = {
+    address = {
+      ipv4.tailscale = "100.119.83.79";
+      ipv6.tailscale = "fd7a:115c:a1e0:cdc1:45b1:c962:aac4:e0dc";
+    };
+  };
+
   den.aspects.kevin = {
     nixos = {
       networking.networkmanager.enable = true;

@@ -1,4 +1,11 @@
 {
+  den.hosts.mobius = {
+    address = {
+      ipv4.tailscale = "100.83.181.200";
+      ipv6.tailscale = "fd7a:115c:a1e0:7f0d:51d5:1a0c:a6a9:2104";
+    };
+  };
+
   den.aspects.mobius = {
     nixos = {
       networking.networkmanager.enable = true;

@@ -1,5 +1,9 @@
 {den, ...}: {
   den.hosts.tribios = {
+    address = {
+      ipv4.tailscale = "100.64.21.193";
+      ipv6.tailscale = "fd7a:115c:a1e0:b5a:53e4:e124:a3ac:614c";
+    };
     settings.services.proxy.dae.interfaces = {
       wan = ["auto"];
       lan = ["br-lan"];

@@ -122,6 +122,11 @@
               default = null;
             };
           };
+          tailscale = lib.mkOption {
+            description = "Clear text of tailscale IPv4 address for this host.";
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
         };
         ipv6 = {
           clearText = lib.mkOption {
@@ -141,6 +146,11 @@
               default = null;
             };
           };
+          tailscale = lib.mkOption {
+            description = "Clear text of tailscale IPv6 address for this host.";
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
         };
       };
     };

@@ -20,6 +20,7 @@
       core.nftables
       core.openssh
       core.systemd
+      core.tailscale
       core.time-sync
       core.utils
 

@@ -114,9 +114,11 @@
             upstream {
               alidns: 'udp://dns.alidns.com:53'
               googledns: 'tcp+udp://dns.google:53'
+              tailscale: 'udp://100.100.100.100:53'
             }
             routing {
               request {
+                qname(suffix: ts.net, suffix: net.trin.one) -> tailscale
                 qname(geosite:category-ads-all) -> reject
                 qtype(https) -> reject
                 qname(geosite:cn) -> alidns
@@ -176,6 +178,12 @@
             dip(geoip:private) -> direct
             domain(geosite:private) -> direct
 
+            # == Tailscale ==
+            dip(100.64.0.0/10) -> direct
+            pname(tailscale, tailscaled) -> direct
+            l4proto(udp) && dport(3478) -> direct
+            l4proto(udp) && sport(41641) -> direct
+
             # == My Hosts ==
             ${hostDirectRule}