nixpkgs/nixos/modules/services/networking/tailscale.nix
Thomas Gerbet f89894e2e3 nixos/tailscale: allow to set TS_PERMIT_CERT_UID env variable
This setting was introduced with Tailscale 1.22.0, see
https://github.com/tailscale/tailscale/releases/tag/v1.22.0

Co-authored-by: pennae <github@quasiparticle.net>
2022-04-17 12:13:24 +02:00

53 lines
1.5 KiB
Nix

{ config, lib, pkgs, ... }:
with lib;
let cfg = config.services.tailscale;
in {
meta.maintainers = with maintainers; [ danderson mbaillie ];
options.services.tailscale = {
enable = mkEnableOption "Tailscale client daemon";
port = mkOption {
type = types.port;
default = 41641;
description = "The port to listen on for tunnel traffic (0=autoselect).";
};
interfaceName = mkOption {
type = types.str;
default = "tailscale0";
description = ''The interface name for tunnel traffic. Use "userspace-networking" (beta) to not use TUN.'';
};
permitCertUid = mkOption {
type = types.nullOr types.nonEmptyStr;
default = null;
description = "Username or user ID of the user allowed to to fetch Tailscale TLS certificates for the node.";
};
package = mkOption {
type = types.package;
default = pkgs.tailscale;
defaultText = literalExpression "pkgs.tailscale";
description = "The package to use for tailscale";
};
};
config = mkIf cfg.enable {
environment.systemPackages = [ cfg.package ]; # for the CLI
systemd.packages = [ cfg.package ];
systemd.services.tailscaled = {
wantedBy = [ "multi-user.target" ];
path = [ pkgs.openresolv pkgs.procps ];
serviceConfig.Environment = [
"PORT=${toString cfg.port}"
''"FLAGS=--tun ${lib.escapeShellArg cfg.interfaceName}"''
] ++ (lib.optionals (cfg.permitCertUid != null) [
"TS_PERMIT_CERT_UID=${cfg.permitCertUid}"
]);
};
};
}