Commit 726d7a9

@@ -45,7 +45,10 @@
       services.headscale = {
         domain = "gate.trin.one";
         port = 3465;
-        derp.enable = true;
+        derp = {
+          enable = true;
+          addPublicServers = true;
+        };
         dns = {
           enable = true;
           domain = "net.trin.one";

@@ -21,6 +21,7 @@
       };
       derp = {
         enable = lib.mkEnableOption "Enable Headscale's builtin DERP server";
+        addPublicServers = lib.mkEnableOption "Add public Tailscale DERP servers to DERP map";
         port = lib.mkOption {
           type = lib.types.port;
           default = 3478;

@@ -89,6 +89,8 @@
         ipv6 = lib.mkIf (hostAddr.ipv6.clearText != null) hostAddr.ipv6.clearText;
       };
 
+      services.headscale.settings.derp.urls = lib.mkIf (!cfg.derp.addPublicServers) [];
+
       networking.firewall.allowedUDPPorts = lib.optional (cfg.derp.enable) cfg.derp.port;
 
       vaultix.secrets = lib.mkMerge (