Archived
beatzaplentyandClaude Sonnet 5
532dc03cfa
Check NixOS configurations / eval-hosts (push) Failing after 10m47s
New build type dedicated to Tailscale exit-node capability, wired up for
linode/proxmox/lxc like every other build type (the lxc variant is the one
actually intended for deployment). Kept separate from the "server" host
rather than bundling exit-node capability onto it.
Trimmed modules/tailscale/exit-node.nix down to pure exit-node behavior:
dropped the old --advertise-routes=${vars.lanCidr} bundling (meaningless
for a Linode-hosted VPS with no path to the LAN), and switched
extraUpFlags -> extraSetFlags. Confirmed against nixpkgs' tailscale.nix
that extraUpFlags is only applied by tailscaled-autoconnect, which itself
only runs when services.tailscale.authKeyFile is set -- nothing in this
repo sets one, so the old flags would never have actually been applied.
extraSetFlags runs unconditionally via tailscaled-set on every boot, so
--advertise-exit-node self-reapplies once the operator has done the
one-time manual `tailscale up` auth.
Verified: all three new targets eval cleanly, nixpkgs-fmt/statix clean,
and a dry-run build of lxc-tailscale-exit-node's tarball resolves its full
closure including tailscaled-set.service.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot
22 lines
862 B
Nix
22 lines
862 B
Nix
{ ... }:
|
|
|
|
{
|
|
imports = [
|
|
../tailscale/exit-node.nix
|
|
];
|
|
|
|
# "server", not "both": this build type only ever advertises itself as an
|
|
# exit node (see ../tailscale/exit-node.nix) -- it doesn't advertise LAN
|
|
# subnet routes, so it doesn't need the "client"-side loose reverse-path
|
|
# filtering that "both" would also turn on. Deliberately left unbundled
|
|
# from LAN-subnet-route advertisement so this build type stays valid on
|
|
# every platform, including linode (a remote VPS with no network path to
|
|
# the home LAN at all).
|
|
services.tailscale.useRoutingFeatures = "server";
|
|
|
|
# Forwarded exit-node traffic arrives on tailscale0 already
|
|
# tailscale-authenticated -- the firewall's normal per-port allow-list
|
|
# would otherwise drop it. Standard NixOS/Tailscale exit-node guidance.
|
|
networking.firewall.trustedInterfaces = [ "tailscale0" ];
|
|
}
|