Archived
beatzaplentyandClaude Sonnet 4.6
e4b335be23
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m37s
The host was always intended as a LAN subnet router (--advertise-routes), not a full exit node (--advertise-exit-node). Rename every trace of "exit-node" to "subnet-router" and remove the --advertise-exit-node flag from extraSetFlags; the operator supplies --advertise-routes at first tailscale up and Tailscale persists it in state across reboots. Routing sysctls (useRoutingFeatures = "server"), openFirewall, and trustedInterfaces = ["tailscale0"] are still required for subnet routing to work, so the module is kept — just correctly named. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TF2dsuKZAiyZWQ1D7CuHJm
20 lines
769 B
Nix
20 lines
769 B
Nix
{ ... }:
|
|
|
|
{
|
|
imports = [
|
|
../tailscale/subnet-router.nix
|
|
];
|
|
|
|
# "server", not "both": this build type advertises LAN subnet routes but
|
|
# doesn't use another tailscale exit node itself, so it doesn't need the
|
|
# "client"-side loose reverse-path filtering that "both" would also enable.
|
|
# Deliberately kept explicit here (not just relying on subnet-router.nix's
|
|
# own setting) so the intent is clear at the build-type level.
|
|
services.tailscale.useRoutingFeatures = "server";
|
|
|
|
# Forwarded subnet-router traffic arrives on tailscale0 already
|
|
# tailscale-authenticated -- the firewall's normal per-port allow-list
|
|
# would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
|
|
networking.firewall.trustedInterfaces = [ "tailscale0" ];
|
|
}
|