New module: modules/headscale.nix
- Headscale service listening on localhost with Nginx reverse proxy
- SQLite database (appropriate for personal use)
- Tailscale public DERP relays for NAT traversal fallback
- MagicDNS enabled with Mullvad/Quad9 upstream resolvers
- Optional OIDC authentication (Google, GitHub, etc.)
- Default auth: pre-shared API keys (headscale apikeys create)
- Added to backup paths (SQLite DB)
- headscale CLI tool added to system packages
Configuration:
- Domain: vpn.ashisgreat.xyz
- OIDC disabled by default (documented how to enable in configuration.nix)
To register a device after deploying:
sudo headscale apikeys create
tailscale up --login-server=https://vpn.ashisgreat.xyz --authkey=<key>
DNS record needed: vpn.ashisgreat.xyz → VPS IP
- Global rate limit: 10 req/s with burst of 20
- Connection limit: 30 concurrent per IP
- Per-domain override support (requests, burst, enable/disable)
- SearXNG gets higher limits (20/40) to tolerate bot traffic
- Returns 429 when rate limited
- Enable DNS-over-TLS (DoT) on port 853 using Nginx's ACME certificates
- Fix an issue where the native NixOS module dropped SOPS client IDs
- Use sops.templates and yq to inject ClientIDs dynamically before start
- Enable allow_unencrypted_doh to fix Nginx proxying DoH correctly
Replace the Podman container and manual YAML templating with the native NixOS module for better system integration and simpler declarative configuration.
AdGuard Home needs write access to working directory.
Config file remains read-only via :ro mount.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Enable crowdsec-firewall-bouncer by default
- Auto-registers bouncer with local CrowdSec API
- Blocks malicious IPs at iptables/nftables level
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove LAPI server config causing null coercion error.
Detection-only mode for now; bouncer can be added later.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove redundant vaultwarden_admin_token from configuration.nix
(already declared in module)
- Remove unused pkgs parameter from vaultwarden module
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add native NixOS Vaultwarden service module
- Supports WebSocket for real-time sync notifications
- Integrates with nginx via extraLocations for /notifications/hub
- Configurable signup, invitations, and SMTP settings
- Uses SOPS for admin token secret management
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Enable web_search tool with Brave provider
- Add openclaw_brave_api_key secret to SOPS configuration
- Add BRAVE_API_KEY to openclaw.env template
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
