forked from lukas/nixos-config
7b848a54bf
Replace the last active credential that still matched the leaked history. Restart Dex and Headscale automatically when their encrypted agenix source files change.
31 lines
679 B
Nix
31 lines
679 B
Nix
{config, pkgs, lib, ...}:
|
|
{
|
|
|
|
services.headscale = {
|
|
enable = true;
|
|
port = 3001;
|
|
settings = {
|
|
server_url = "https://head.${config.domain}";
|
|
dns.base_domain = "hn.${config.domain}";
|
|
dns.nameservers.global = [ config.tailnetIPs.blunix ];
|
|
logtail.enabled = false;
|
|
oidc = {
|
|
client_id = "headscale";
|
|
client_secret_path = config.age.secrets.oidcHeadscale.path;
|
|
issuer = "https://dex.${config.domain}/dex";
|
|
scope = [
|
|
"openid"
|
|
"profile"
|
|
"email"
|
|
"groups"
|
|
];
|
|
allowed_groups = [ "intern" ];
|
|
};
|
|
};
|
|
};
|
|
|
|
systemd.services.headscale.restartTriggers = [
|
|
config.age.secrets.oidcHeadscale.file
|
|
];
|
|
|
|
}
|