added tailscale-router beszel secret

Reviewed-on: #72

modules/build-types/docker.nix

@@ -15,7 +15,6 @@
     ../docker/enable-service.nix
     ../docker/nextcloud-cron-job.nix
     ../docker/docker-health-to-gotify.nix
-    ../tailscale/enable-service.nix
     ../traefik/rotate-logs.nix
     ../raspi/mount-data.nix
     ../services/enable-rpcbind.nix

modules/build-types/tailscale-router.nix

@@ -17,29 +17,27 @@
   # Must also be approved in the Tailscale admin console (Machines → Edit route settings).
   services.tailscale.extraUpFlags = [ "--advertise-routes=${vars.lanCidr}" ];
 
-  networking = {
-    # SNAT traffic from LAN machines going out through Tailscale so the remote
-    # peer sees it sourced from this router's Tailscale IP (100.x.x.x) rather
-    # than a raw LAN IP.  Without this, Tailscale drops the forwarded packets
-    # because the source is not a recognised Tailscale address.
-    #
-    # networking.nat.externalInterface alone does not insert a MASQUERADE rule
-    # (it only does so when internalInterfaces is also set).  We use
-    # extraCommands to add the rule into the nixos-nat-post chain that
-    # networking.nat.enable creates, and extraStopCommands to clean it up.
-    nat.enable = true;
+  networking.firewall = {
+    # Forwarded subnet-router traffic arrives on tailscale0 already
+    # tailscale-authenticated -- the firewall's normal per-port allow-list
+    # would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
+    trustedInterfaces = [ "tailscale0" ];
 
-    firewall = {
-      # Forwarded subnet-router traffic arrives on tailscale0 already
-      # tailscale-authenticated -- the firewall's normal per-port allow-list
-      # would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
-      trustedInterfaces = [ "tailscale0" ];
-      extraCommands = ''
-        iptables -t nat -A nixos-nat-post -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE
-      '';
-      extraStopCommands = ''
-        iptables -t nat -D nixos-nat-post -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE 2>/dev/null || true
-      '';
-    };
+    # SNAT LAN traffic going into Tailscale so the remote peer sees it as
+    # coming from this router's Tailscale IP rather than a raw LAN IP.
+    # Without this, Tailscale drops forwarded packets whose source is not a
+    # recognised Tailscale address.
+    #
+    # We target POSTROUTING directly (always-existing built-in chain) rather
+    # than nixos-nat-post: extraCommands runs after the old nixos-nat-post is
+    # deleted but before the new one is created, so -A nixos-nat-post silently
+    # fails.  The -C check makes the rule idempotent across firewall reloads.
+    extraCommands = ''
+      iptables -t nat -C POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE 2>/dev/null || \
+        iptables -t nat -A POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE
+    '';
+    extraStopCommands = ''
+      iptables -t nat -D POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE 2>/dev/null || true
+    '';
   };
 }

secrets/tailscale-router.yaml

@@ -0,0 +1,43 @@
+beszel-token: ENC[AES256_GCM,data:qg2eb7Eq/w7vIuiiDeK/s6h9nmHWuooyrd93GvdLD2hGOvka,iv:FWRBQTIY9PzV2V8J7z5ftEb5dvjN/S0hP0H9JV+Uuq8=,tag:WP7DHOu4elfqdLoW7vo9qg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCZmozK3VjcENGb3l2MDNj
+            QVE3VVI3Z3R0MjduSlJGL3BFWkg5NHZmZms0CkNBTWZKZFJVNkJMZ0tpNXhXWW5q
+            WndvbmhuOVh5ZHhJMmJwenh0M2dEVlUKLS0tIGpXQ3dhRXVWUDZzdGg4RHN4V3p0
+            WDZnK1lMUHVIS09hRUEzVHRHQ0EwcWsKEd5NtstHSPH8okXcFLW7BId5xPGmgyC3
+            dAodIGkLBlJlaL1bZuRy6Vaac+mJZL5KJYD/o1kYSXRiHJfNpaulTg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXWWhYOFU3VHZ3S1VuRTF2
+            QlZvMkJUNDZmT1RDWWZsMkxnZjJldjdrRG44CkU0NEJTR0NhQUpjMEY4RXBLSVBJ
+            bDNtZ1UrRDNUbzA0NDJ1cWJKdlBBMWMKLS0tIE9vTmEzTUxpODF4SG1MQ1czM1N5
+            dVgrMERMRXJwVmhtMldTZUlHNUJVTEkKzUf9cETbo0K9bCPkrlbUkgkhRIPvjCHR
+            GFVwgb2fcaOzZHcDwlLDLaP6HbRPtzJfVbLpQ1XU0N/xijSr9ENB6g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1f7usptjx9rv4rxauasve200gxtdt9jkqhhdqstlf20wvlm7u75rsjfw50m
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlOVdWN0tHNWZmaWlWQ2hJ
+            MVFYd0pMNmJTdTlJQ3h1c0dzbDE3U2VqdzNzCitCcFdhbjRPYnl3Q214WnRxa2Jq
+            eTFnc2VBcXlGcTVYdWpWTFZiWXBMUDAKLS0tIC9YdVkrTU5EeXNlNzliLzBlYUR2
+            Qk1ITW9tMElzUHF4MVJyWS9uRGs1QncKj8OgxWYabf8MccWD6zYLxl+FvYPAvLCW
+            p/FJ8uMa9YWp0RjICvWIwyO0gK7oaxTh/JzfBjABngEZnZazNYP7Uw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1k7d2du5mejsmv5rzavm4xwgpthqvcfsehduquv28nzs53zppa3kqngfxq2
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsbzFKckFQVDg0VEpJMFlv
+            WSs1ODVoYlZZK3YrSXlMU1hIQjdLTUhNdHhJCkRnbHY5Z2NGQVMvOHV4R2hTd0xu
+            LzdheXdZVVBsTjhVOU8zZGFKN0lPWjQKLS0tIFdaaG5SeElDN3YvMjFxdHVLWlNX
+            M1BQQmtJTUdsK2x5TEo5TmNrMEZidkEKhi4jNKhrkBAPhJoeYNg1d60LQTqmJt+G
+            Z/2X5uWzh12zF5keL8cNHH6sD0z0MOChtd4UF37yr+lb/LFJkia6LQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zhfyuzlq40reuqlr34gf77852nhs3t6mqfzrqmas8z6sxk7tcfhsungrm0
+    lastmodified: "2026-07-26T01:12:11Z"
+    mac: ENC[AES256_GCM,data:0r68y6XmdiW7p/h9QmTR5h37TxKp+0wF44LP8QfG6cGP0tvaasuvv+V9EC3msnREYjwJhlnHjRd8hJ31HGVkOHbYWI4V5cF4ZnaiGgrZJhsGcJvOJSroAvQwev+vIlXZpAPgZz3Z35FDvOpgb71l5c0so0l4EJhc70JOh2FxhvQ=,iv:Or6l/v/E01+9wtZwyl+pCttiuReR6V0kmBzE9KhsfgQ=,tag:cAEUgj/9tKDToKFr00g5UQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2