Archived
beatzaplentyandClaude Sonnet 4.6
c844ccc4e3
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m28s
Complete the rename so all identifiers match networking.hostName: - flake.nix: attribute names and buildType strings (linode/proxmox/lxc-tailscale-subnet-router → *-tailscale-router) - modules/build-types/tailscale-subnet-router.nix → tailscale-router.nix - .sops.yaml: anchor and alias names (age keys unchanged, no re-encrypt needed) - host-keys/: local gitignored key files renamed (not committed) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
20 lines
769 B
Nix
20 lines
769 B
Nix
{ ... }:
|
|
|
|
{
|
|
imports = [
|
|
../tailscale/subnet-router.nix
|
|
];
|
|
|
|
# "server", not "both": this build type advertises LAN subnet routes but
|
|
# doesn't use another tailscale exit node itself, so it doesn't need the
|
|
# "client"-side loose reverse-path filtering that "both" would also enable.
|
|
# Deliberately kept explicit here (not just relying on subnet-router.nix's
|
|
# own setting) so the intent is clear at the build-type level.
|
|
services.tailscale.useRoutingFeatures = "server";
|
|
|
|
# Forwarded subnet-router traffic arrives on tailscale0 already
|
|
# tailscale-authenticated -- the firewall's normal per-port allow-list
|
|
# would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
|
|
networking.firewall.trustedInterfaces = [ "tailscale0" ];
|
|
}
|