Archived
beatzaplentyandClaude Sonnet 5
9724babcea
New build type dedicated to Tailscale exit-node capability, wired up for
linode/proxmox/lxc like every other build type (the lxc variant is the one
actually intended for deployment). Kept separate from the "server" host
rather than bundling exit-node capability onto it.
Trimmed modules/tailscale/exit-node.nix down to pure exit-node behavior:
dropped the old --advertise-routes=${vars.lanCidr} bundling (meaningless
for a Linode-hosted VPS with no path to the LAN), and switched
extraUpFlags -> extraSetFlags. Confirmed against nixpkgs' tailscale.nix
that extraUpFlags is only applied by tailscaled-autoconnect, which itself
only runs when services.tailscale.authKeyFile is set -- nothing in this
repo sets one, so the old flags would never have actually been applied.
extraSetFlags runs unconditionally via tailscaled-set on every boot, so
--advertise-exit-node self-reapplies once the operator has done the
one-time manual `tailscale up` auth.
Verified: all three new targets eval cleanly, nixpkgs-fmt/statix clean,
and a dry-run build of lxc-tailscale-exit-node's tarball resolves its full
closure including tailscaled-set.service.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot
20 lines
645 B
Nix
20 lines
645 B
Nix
_:
|
|
|
|
{
|
|
services.tailscale = {
|
|
enable = true;
|
|
|
|
# extraSetFlags (tailscale set, via the always-on tailscaled-set
|
|
# service), not extraUpFlags -- extraUpFlags is only ever applied by
|
|
# tailscaled-autoconnect, which itself only runs when
|
|
# services.tailscale.authKeyFile is set (nothing in this repo sets one,
|
|
# so tailscale up is a manual, one-time operator step on every host that
|
|
# uses this service). extraSetFlags has no such gate, so
|
|
# --advertise-exit-node self-reapplies on every boot once the operator
|
|
# has authenticated the node once.
|
|
extraSetFlags = [
|
|
"--advertise-exit-node"
|
|
];
|
|
};
|
|
}
|