Try tailscale

linux/blitzar/default.nix

@@ -12,6 +12,7 @@
     ./network.nix
     ./locale.nix
     ./syncthing.nix
+    ./tailscale.nix
     ./zfs.nix
     ../../common
   ];

linux/blitzar/gui.nix

@@ -70,11 +70,6 @@
   };
 
   programs = {
-    clash-verge = {
-      enable = true;
-      tunMode = true;
-      autoStart = true;
-    };
     dconf.enable = true;
     steam.enable = true;
   };

linux/blitzar/network.nix

@@ -7,17 +7,7 @@
       wifi.backend = "iwd";
     };
     nftables.enable = true;
-    wireguard.interfaces.wgb = {
-      ips = [ "10.32.54.2/32" ];
-      peers = [{
-        allowedIPs = [ "10.32.54.0/24" ];
-        endpoint = "${const.domain}:${toString const.port.wireguard-server}";
-        publicKey = "0j8+alXU/f2UgWN61R6+Wjs9xelGRwpSbe5NyOwWlF4=";
-      }];
-      privateKeyFile = config.sops.secrets."wireguard/${config.networking.hostName}".path;
-    };
     wireless.iwd.enable = true;
   };
   services.resolved.enable = true;
-  sops.secrets."wireguard/${config.networking.hostName}" = { };
 }

linux/blitzar/tailscale.nix

@@ -0,0 +1,7 @@
+{ ... }: {
+  services.tailscale = {
+    enable = true;
+    port = 22276;
+    useRoutingFeatures = "client";
+  };
+}

linux/nebula/conduit.nix

@@ -5,6 +5,7 @@
     enable = true;
     settings.global = {
       address = config.constants.localhost;
+      port = 29800;
       server_name = config.constants.domain;
     };
   };

linux/nebula/default.nix

@@ -15,6 +15,7 @@
     ./jellyfin.nix
     ./network.nix
     ./syncthing.nix
+    ./tailscale.nix
     ./zfs.nix
     ../../common
   ];

linux/nebula/forgejo.nix

@@ -9,6 +9,7 @@
       server = let dn = config.constants.domain; in {
         DOMAIN = dn;
         HTTP_ADDR = config.constants.localhost;
+        HTTP_PORT = 47674;
         ROOT_URL = "https://forgejo.${dn}";
       };
       service.DISABLE_REGISTRATION = true;

linux/nebula/network.nix

@@ -11,16 +11,6 @@ let const = config.constants; hn = config.networking.hostName; in {
     };
     nftables.enable = true;
     tempAddresses = "disabled";
-    wireguard.interfaces.wgn = {
-      ips = [ "10.32.54.3/32" ];
-      peers = [{
-        allowedIPs = [ "10.32.54.0/24" ];
-        endpoint = "${const.domain}:${toString const.port.wireguard-server}";
-        persistentKeepalive = 54;
-        publicKey = "0j8+alXU/f2UgWN61R6+Wjs9xelGRwpSbe5NyOwWlF4=";
-      }];
-      privateKeyFile = config.sops.secrets."wireguard/${hn}".path;
-    };
     wireless.iwd.enable = true;
   };
 
@@ -48,8 +38,5 @@ let const = config.constants; hn = config.networking.hostName; in {
     resolved.enable = true;
   };
 
-  sops.secrets = {
-    "cloudflare/${hn}" = { };
-    "wireguard/${hn}" = { };
-  };
+  sops.secrets."cloudflare/${hn}" = { };
 }

linux/nebula/tailscale.nix

@@ -0,0 +1,8 @@
+{ ... }: {
+  services.tailscale = {
+    enable = true;
+    extraUpFlags = [ "--advertise-exit-node" ];
+    port = 25555;
+    useRoutingFeatures = "both";
+  };
+}

linux/singularity/caddy.nix

@@ -7,6 +7,7 @@
     virtualHosts =
       let
         dn = config.constants.domain;
+        hsCfg = config.services.headscale;
         msfqdn = config.mailserver.fqdn;
         mtfqdn = "matrix.${dn}";
         vaultCfg = config.services.vaultwarden.config;
@@ -22,6 +23,9 @@
             "m.identity_server": { "base_url": "https://${mtfqdn}" }
           }`
         '';
+        "headscale.${dn}".extraConfig = ''
+          reverse_proxy ${hsCfg.address}:${toString hsCfg.port}
+        '';
         ${msfqdn} = {
           extraConfig = ''
             file_server ${wn "acme-challenge"}/* {

linux/singularity/default.nix

@@ -4,10 +4,10 @@
     ./caddy.nix
     ./configuration.nix
     ./hardware-configuration.nix
+    ./headscale.nix
     ./mailserver.nix
     ./network.nix
     ./vaultwarden.nix
-    ./xray.nix
     ../../common
   ];
 }

linux/singularity/headscale.nix

@@ -0,0 +1,18 @@
+{ config, ... }:
+
+{
+  services = let const = config.constants; in {
+    headscale = {
+      enable = true;
+      address = const.localhost;
+      port = 27327;
+      settings.server_url = "https://headscale.${const.domain}";
+    };
+    tailscale = {
+      enable = true;
+      extraUpFlags = [ "--advertise-exit-node" ];
+      port = 27919;
+      useRoutingFeatures = "both";
+    };
+  };
+}

linux/singularity/network.nix

@@ -1,34 +1,13 @@
 { config, ... }:
 
-let hn = config.networking.hostName; port = config.constants.port; wgi = "wgs"; in {
+let hn = config.networking.hostName; in {
   networking = {
     domain = config.constants.domain;
     firewall = {
-      allowedTCPPorts = with port; [ http https xray ];
-      allowedUDPPorts = with port; [ wireguard-server ];
+      allowedTCPPorts = with config.constants.port; [ http https ];
     };
     hostId = "2cadb253";
-    nat = {
-      enable = true;
-      externalInterface = "ens18";
-      internalInterfaces = [ wgi ];
-    };
     nftables.enable = true;
-    wireguard.interfaces.${wgi} = {
-      ips = [ "10.32.54.76/24" ];
-      listenPort = port.wireguard-server;
-      peers = [
-        {
-          allowedIPs = [ "10.32.54.2/32" ];
-          publicKey = "RhS1H8g47EnOhu1F6y3QO6XqxnabGcNNb0BixBuKkDQ=";
-        }
-        {
-          allowedIPs = [ "10.32.54.3/32" ];
-          publicKey = "1OA03mqu7SxREAum4UabJKD7hf+foPLu1j0E1N5K508=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets."wireguard/${hn}".path;
-    };
   };
 
   services = {
@@ -53,8 +32,5 @@ let hn = config.networking.hostName; port = config.constants.port; wgi = "wgs";
     resolved.enable = true;
   };
 
-  sops.secrets = {
-    "cloudflare/${hn}" = { };
-    "wireguard/${hn}" = { };
-  };
+  sops.secrets."cloudflare/${hn}" = { };
 }

linux/singularity/xray.nix

@@ -1,10 +0,0 @@
-{ config, ... }:
-
-let xrayCfg = "xray/config.json"; in {
-  services.xray = {
-    enable = true;
-    settingsFile = config.sops.secrets.${xrayCfg}.path;
-  };
-
-  sops.secrets.${xrayCfg}.mode = "0444";
-}