added tailscale-router beszel secret

removed tailscale from docker updated secrets
Merge pull request 'feat(beszel): add beszel agent to tailscale-router' (#72 ) from worktree-beszel-tailscale-router into main
2026-07-26 11:14:05 +10:00 · 2026-07-26 11:12:46 +10:00 · 2026-07-26 01:08:29 +00:00 · 2026-07-26 11:07:51 +10:00 · 2026-07-26 00:01:48 +00:00 · 2026-07-25 23:56:11 +00:00
5 changed files with 63 additions and 1 deletions
@@ -77,6 +77,14 @@ creation_rules:
          - *admin
          - *lxc-tor-relay

+  - path_regex: secrets/tailscale-router\.yaml$
+    key_groups:
+      - age:
+          - *admin
+          - *linode-tailscale-router
+          - *lxc-tailscale-router
+          - *proxmox-tailscale-router
+
  # gui-host-specific secrets (currently: wifi-password, see
  # modules/networking/wifi.nix). Only *lxc-gui has a registered key today
  # -- proxmox-gui/linode-gui/baremetal-gui haven't been provisioned via
@@ -1,8 +1,19 @@
 _:

 {
+  imports = [
+    (import ../../modules/beszel/host-token.nix {
+      name = "tailscale-router";
+      sopsFile = ../../secrets/tailscale-router.yaml;
+    })
+  ];
+
  networking.hostName = "tailscale-router";

+  services.beszel.agent.environment = {
+    KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
+  };
+
  # No networking.hostId: only ZFS-touching hosts (server, docker) need one
  # for pool-import safety, and this host does neither.

@@ -15,7 +15,6 @@
    ../docker/enable-service.nix
    ../docker/nextcloud-cron-job.nix
    ../docker/docker-health-to-gotify.nix
-    ../tailscale/enable-service.nix
    ../traefik/rotate-logs.nix
    ../raspi/mount-data.nix
    ../services/enable-rpcbind.nix
@@ -3,6 +3,7 @@
 {
  imports = [
    ../tailscale/subnet-router.nix
+    ../beszel/enable-agent.nix
  ];

  # "server", not "both": this build type advertises LAN subnet routes but
@@ -0,0 +1,43 @@
+beszel-token: ENC[AES256_GCM,data:qg2eb7Eq/w7vIuiiDeK/s6h9nmHWuooyrd93GvdLD2hGOvka,iv:FWRBQTIY9PzV2V8J7z5ftEb5dvjN/S0hP0H9JV+Uuq8=,tag:WP7DHOu4elfqdLoW7vo9qg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCZmozK3VjcENGb3l2MDNj
+            QVE3VVI3Z3R0MjduSlJGL3BFWkg5NHZmZms0CkNBTWZKZFJVNkJMZ0tpNXhXWW5q
+            WndvbmhuOVh5ZHhJMmJwenh0M2dEVlUKLS0tIGpXQ3dhRXVWUDZzdGg4RHN4V3p0
+            WDZnK1lMUHVIS09hRUEzVHRHQ0EwcWsKEd5NtstHSPH8okXcFLW7BId5xPGmgyC3
+            dAodIGkLBlJlaL1bZuRy6Vaac+mJZL5KJYD/o1kYSXRiHJfNpaulTg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXWWhYOFU3VHZ3S1VuRTF2
+            QlZvMkJUNDZmT1RDWWZsMkxnZjJldjdrRG44CkU0NEJTR0NhQUpjMEY4RXBLSVBJ
+            bDNtZ1UrRDNUbzA0NDJ1cWJKdlBBMWMKLS0tIE9vTmEzTUxpODF4SG1MQ1czM1N5
+            dVgrMERMRXJwVmhtMldTZUlHNUJVTEkKzUf9cETbo0K9bCPkrlbUkgkhRIPvjCHR
+            GFVwgb2fcaOzZHcDwlLDLaP6HbRPtzJfVbLpQ1XU0N/xijSr9ENB6g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1f7usptjx9rv4rxauasve200gxtdt9jkqhhdqstlf20wvlm7u75rsjfw50m
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlOVdWN0tHNWZmaWlWQ2hJ
+            MVFYd0pMNmJTdTlJQ3h1c0dzbDE3U2VqdzNzCitCcFdhbjRPYnl3Q214WnRxa2Jq
+            eTFnc2VBcXlGcTVYdWpWTFZiWXBMUDAKLS0tIC9YdVkrTU5EeXNlNzliLzBlYUR2
+            Qk1ITW9tMElzUHF4MVJyWS9uRGs1QncKj8OgxWYabf8MccWD6zYLxl+FvYPAvLCW
+            p/FJ8uMa9YWp0RjICvWIwyO0gK7oaxTh/JzfBjABngEZnZazNYP7Uw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1k7d2du5mejsmv5rzavm4xwgpthqvcfsehduquv28nzs53zppa3kqngfxq2
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsbzFKckFQVDg0VEpJMFlv
+            WSs1ODVoYlZZK3YrSXlMU1hIQjdLTUhNdHhJCkRnbHY5Z2NGQVMvOHV4R2hTd0xu
+            LzdheXdZVVBsTjhVOU8zZGFKN0lPWjQKLS0tIFdaaG5SeElDN3YvMjFxdHVLWlNX
+            M1BQQmtJTUdsK2x5TEo5TmNrMEZidkEKhi4jNKhrkBAPhJoeYNg1d60LQTqmJt+G
+            Z/2X5uWzh12zF5keL8cNHH6sD0z0MOChtd4UF37yr+lb/LFJkia6LQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zhfyuzlq40reuqlr34gf77852nhs3t6mqfzrqmas8z6sxk7tcfhsungrm0
+    lastmodified: "2026-07-26T01:12:11Z"
+    mac: ENC[AES256_GCM,data:0r68y6XmdiW7p/h9QmTR5h37TxKp+0wF44LP8QfG6cGP0tvaasuvv+V9EC3msnREYjwJhlnHjRd8hJ31HGVkOHbYWI4V5cF4ZnaiGgrZJhsGcJvOJSroAvQwev+vIlXZpAPgZz3Z35FDvOpgb71l5c0so0l4EJhc70JOh2FxhvQ=,iv:Or6l/v/E01+9wtZwyl+pCttiuReR6V0kmBzE9KhsfgQ=,tag:cAEUgj/9tKDToKFr00g5UQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
Author	SHA1	Message	Date
beatzaplenty	bf88a6ebb0	added tailscale-router beszel secret Check NixOS configurations / eval-hosts (push) Successful in 10m22s Details	2026-07-26 11:14:05 +10:00
beatzaplenty	de508141a8	removed tailscale from docker updated secrets Check NixOS configurations / eval-hosts (push) Successful in 10m33s Details	2026-07-26 11:12:46 +10:00
beatzaplenty	18cd9c2342	Merge pull request 'feat(beszel): add beszel agent to tailscale-router' (#72 ) from worktree-beszel-tailscale-router into main Check NixOS configurations / eval-hosts (push) Failing after 11m27s Details Reviewed-on: #72	2026-07-26 01:08:29 +00:00
beatzaplentyandClaude Sonnet 4.6	997918e2f7	feat(beszel): add beszel agent to tailscale-router Check NixOS configurations / eval-hosts (pull_request) Failing after 11m33s Details Wires beszel-agent into all tailscale-router variants (lxc/linode/proxmox) by importing enable-agent.nix in the build type and host-token.nix in the host file. Adds the sops creation rule for secrets/tailscale-router.yaml (all three platform variants as recipients). The secrets file must be created manually before deploying — see instructions in PR. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-26 11:07:51 +10:00
beatzaplenty	9872b8ff1d	Merge pull request 'fix(tailscale-router): add MASQUERADE to POSTROUTING, not nixos-nat-post' (#71 ) from worktree-lovely-spinning-bubble into main Check NixOS configurations / eval-hosts (push) Successful in 10m43s Details Reviewed-on: #71	2026-07-26 00:01:48 +00:00
beatzaplenty	2860f750b4	Merge pull request 'fix(tailscale-router): actually insert MASQUERADE rule via extraCommands' (#70 ) from worktree-lovely-spinning-bubble into main Check NixOS configurations / eval-hosts (push) Successful in 10m34s Details Reviewed-on: #70	2026-07-25 23:56:11 +00:00
beatzaplenty	3014a45936	Merge pull request 'fix(tailscale-router): masquerade LAN traffic into Tailscale' (#69 ) from worktree-lovely-spinning-bubble into main Check NixOS configurations / eval-hosts (push) Successful in 10m30s Details Reviewed-on: #69	2026-07-25 23:48:13 +00:00