this repo has no description
feat(wolumonde): fix headscale acl [skip ci]
+67
-89
+6
-28
hosts/wolumonde/modules/headscale.nix/acl.hujson
+6
-28
hosts/wolumonde/modules/headscale.nix/acl.hujson
···
1
1
{
2
-
// Headscale ACL Configuration
3
-
// Defines groups, tags, and access control rules
4
-
5
-
// Groups define collections of users
6
2
"groups": {
7
-
"group:admin": ["90008@"],
3
+
"group:admin": ["90008@gaze.systems"],
8
4
},
9
-
10
-
// Tags are used to label devices/nodes for access control
11
5
"tagOwners": {
12
6
"tag:private-infra": ["group:admin"],
13
7
"tag:other-infra": ["group:admin"],
14
8
},
15
-
16
-
// Access Control Lists - define what can access what
17
9
"acls": [
18
-
// Admin group (user 90008) can access their own devices
19
10
{
20
11
"action": "accept",
21
12
"src": ["group:admin"],
22
-
"dst": ["group:admin:*"],
13
+
"dst": ["tag:private-infra:*", "tag:other-infra:*"],
23
14
},
24
-
25
-
// Private infrastructure can access other infrastructure
26
15
{
27
16
"action": "accept",
28
17
"src": ["tag:private-infra"],
29
18
"dst": ["tag:other-infra:*"],
30
19
},
31
-
32
-
// Private infrastructure can access itself
33
20
{
34
21
"action": "accept",
35
-
"src": ["tag:private-infra"],
36
-
"dst": ["tag:private-infra:*"],
22
+
"src": ["90008@gaze.systems"],
23
+
"dst": ["90008@gaze.systems:*"],
37
24
},
38
-
39
-
// Other infrastructure can access itself
40
25
{
41
26
"action": "accept",
42
-
"src": ["tag:other-infra"],
43
-
"dst": ["tag:other-infra:*"],
44
-
},
45
-
46
-
// Admin group can access both infrastructure tags
47
-
{
48
-
"action": "accept",
49
-
"src": ["group:admin"],
50
-
"dst": ["tag:private-infra:*", "tag:other-infra:*"],
27
+
"src": ["90008@gaze.systems", "tag:private-infra"],
28
+
"dst": ["autogroup:internet:*"],
51
29
},
52
30
],
53
31
}
+1
-1
hosts/wolumonde/modules/headscale.nix/default.nix
+1
-1
hosts/wolumonde/modules/headscale.nix/default.nix
-60
hosts/wolumonde/modules/nsid-tracker.disabled
-60
hosts/wolumonde/modules/nsid-tracker.disabled
···
1
-
{
2
-
pkgs,
3
-
terra,
4
-
inputs,
5
-
...
6
-
}:
7
-
let
8
-
client-modules =
9
-
(pkgs.callPackage "${inputs.nsid-tracker}/nix/client-modules.nix" {})
10
-
.overrideAttrs (_: {
11
-
outputHash = "sha256-TzTafbNTng/mMyf0yR9Rc6XS9/zzipwmK9SUWm2XxeY=";
12
-
});
13
-
client = pkgs.callPackage "${inputs.nsid-tracker}/nix/client.nix" {
14
-
PUBLIC_API_URL = "gaze.systems/nsid-tracker/api";
15
-
inherit client-modules;
16
-
};
17
-
server = terra.nsid-tracker-server;
18
-
port = 6432;
19
-
in
20
-
{
21
-
users.users.nsidtracker = {
22
-
isSystemUser = true;
23
-
home = "/mnt/data/nsid-tracker";
24
-
createHome = true;
25
-
group = "nsidtracker";
26
-
};
27
-
users.groups.nsidtracker = { };
28
-
29
-
systemd.services.nsid-tracker = {
30
-
description = "nsid-tracker";
31
-
wantedBy = [ "multi-user.target" ];
32
-
after = [ "network.target" ];
33
-
environment = {
34
-
HOME = "/mnt/data/nsid-tracker";
35
-
PORT = toString port;
36
-
};
37
-
serviceConfig = {
38
-
User = "nsidtracker";
39
-
ExecStart = "${server}/bin/server";
40
-
Restart = "on-failure";
41
-
RestartSec = 5;
42
-
WorkingDirectory = "/mnt/data/nsid-tracker";
43
-
};
44
-
};
45
-
46
-
services.nginx.virtualHosts."gaze.systems" = {
47
-
locations."/nsid-tracker/api" = {
48
-
proxyPass = "http://localhost:${toString port}/";
49
-
proxyWebsockets = true;
50
-
extraConfig = ''
51
-
rewrite ^/nsid-tracker/api/(.*) /$1 break;
52
-
'';
53
-
};
54
-
locations."/nsid-tracker".return = "301 /nsid-tracker/";
55
-
locations."/nsid-tracker/" = {
56
-
alias = "${client}/";
57
-
tryFiles = "$uri $uri/ /index.html";
58
-
};
59
-
};
60
-
}
+60
hosts/wolumonde/modules/nsid-tracker.nix
+60
hosts/wolumonde/modules/nsid-tracker.nix
···
1
+
{
2
+
pkgs,
3
+
terra,
4
+
inputs,
5
+
...
6
+
}:
7
+
let
8
+
client-modules =
9
+
(pkgs.callPackage "${inputs.nsid-tracker}/nix/client-modules.nix" {})
10
+
.overrideAttrs (_: {
11
+
outputHash = "sha256-TzTafbNTng/mMyf0yR9Rc6XS9/zzipwmK9SUWm2XxeY=";
12
+
});
13
+
client = pkgs.callPackage "${inputs.nsid-tracker}/nix/client.nix" {
14
+
PUBLIC_API_URL = "gaze.systems/nsid-tracker/api";
15
+
inherit client-modules;
16
+
};
17
+
# server = terra.nsid-tracker-server;
18
+
port = 3713;
19
+
in
20
+
{
21
+
# users.users.nsidtracker = {
22
+
# isSystemUser = true;
23
+
# home = "/mnt/data/nsid-tracker";
24
+
# createHome = true;
25
+
# group = "nsidtracker";
26
+
# };
27
+
# users.groups.nsidtracker = { };
28
+
29
+
# systemd.services.nsid-tracker = {
30
+
# description = "nsid-tracker";
31
+
# wantedBy = [ "multi-user.target" ];
32
+
# after = [ "network.target" ];
33
+
# environment = {
34
+
# HOME = "/mnt/data/nsid-tracker";
35
+
# PORT = toString port;
36
+
# };
37
+
# serviceConfig = {
38
+
# User = "nsidtracker";
39
+
# ExecStart = "${server}/bin/server";
40
+
# Restart = "on-failure";
41
+
# RestartSec = 5;
42
+
# WorkingDirectory = "/mnt/data/nsid-tracker";
43
+
# };
44
+
# };
45
+
46
+
services.nginx.virtualHosts."gaze.systems" = {
47
+
locations."/nsid-tracker/api" = {
48
+
proxyPass = "http://dusk-devel-mobi:${toString port}/";
49
+
proxyWebsockets = true;
50
+
extraConfig = ''
51
+
rewrite ^/nsid-tracker/api/(.*) /$1 break;
52
+
'';
53
+
};
54
+
locations."/nsid-tracker".return = "301 /nsid-tracker/";
55
+
locations."/nsid-tracker/" = {
56
+
alias = "${client}/";
57
+
tryFiles = "$uri $uri/ /index.html";
58
+
};
59
+
};
60
+
}