Add headscale

modules/default.nix

@@ -24,5 +24,6 @@
     ./foundryvtt.nix
     ./immich.nix
     ./forgejo.nix
+    ./headscale.nix
   ];
 }

modules/headscale.nix

@@ -0,0 +1,55 @@
+{ config, lib, ... }:
+with lib;
+let
+  cfg = config.custom.services.headscale;
+  domain = "hs.${config.networking.domain}";
+in
+{
+  options.custom.services.headscale = {
+    enable = mkEnableOption "headscale";
+  };
+
+  config = mkIf cfg.enable {
+
+    services.headscale = {
+      enable = true;
+      port = 28080;
+      settings = {
+        server_url = "https://${domain}";
+        derp = {
+          server = {
+            enabled = true;
+            stun_listen_addr = "0.0.0.0:4478";
+          };
+          # urls = [ ];
+          auto_update_enabled = false;
+        };
+        dns = {
+          base_domain = "ts.net";
+          nameservers = {
+            split = {
+              "foyer.cloud" = "10.33.0.100";
+              "foyer.lu" = "10.33.0.100";
+              "lefoyer.lu" = "10.33.0.100";
+            };
+          };
+        };
+      };
+    };
+
+    services.nginx.virtualHosts.${domain} = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${toString config.services.headscale.port}";
+        proxyWebsockets = true;
+      };
+    };
+
+    networking = {
+      firewall.allowedUDPPorts = [
+        4478
+      ];
+    };
+  };
+}

profiles/hel.nix

@@ -233,6 +233,7 @@
     monitoring-exporters.enable = true;
     immich.enable = true;
     forgejo.enable = true;
+    headscale.enable = true;
 
     backup-job = {
       enable = true;

terraform/dns.tf

@@ -229,6 +229,14 @@ resource "hetznerdns_record" "ch_a" {
   ttl     = 600
 }
 
+resource "hetznerdns_record" "hs_a" {
+  zone_id = data.hetznerdns_zone.banditlair_zone.id
+  name    = "hs"
+  value   = local.hel1_ip
+  type    = "A"
+  ttl     = 600
+}
+
 # Email
 resource "hetznerdns_record" "mail_mx" {
   zone_id = data.hetznerdns_zone.banditlair_zone.id