Try tailscale

linux/singularity/caddy.nix

@@ -7,6 +7,7 @@
     virtualHosts =
       let
         dn = config.constants.domain;
+        hsCfg = config.services.headscale;
         msfqdn = config.mailserver.fqdn;
         mtfqdn = "matrix.${dn}";
         vaultCfg = config.services.vaultwarden.config;
@@ -22,6 +23,9 @@
             "m.identity_server": { "base_url": "https://${mtfqdn}" }
           }`
         '';
+        "headscale.${dn}".extraConfig = ''
+          reverse_proxy ${hsCfg.address}:${toString hsCfg.port}
+        '';
         ${msfqdn} = {
           extraConfig = ''
             file_server ${wn "acme-challenge"}/* {

linux/singularity/default.nix

@@ -4,10 +4,10 @@
     ./caddy.nix
     ./configuration.nix
     ./hardware-configuration.nix
+    ./headscale.nix
     ./mailserver.nix
     ./network.nix
     ./vaultwarden.nix
-    ./xray.nix
     ../../common
   ];
 }

linux/singularity/headscale.nix

@@ -0,0 +1,18 @@
+{ config, ... }:
+
+{
+  services = let const = config.constants; in {
+    headscale = {
+      enable = true;
+      address = const.localhost;
+      port = 27327;
+      settings.server_url = "https://headscale.${const.domain}";
+    };
+    tailscale = {
+      enable = true;
+      extraUpFlags = [ "--advertise-exit-node" ];
+      port = 27919;
+      useRoutingFeatures = "both";
+    };
+  };
+}

linux/singularity/network.nix

@@ -1,34 +1,13 @@
 { config, ... }:
 
-let hn = config.networking.hostName; port = config.constants.port; wgi = "wgs"; in {
+let hn = config.networking.hostName; in {
   networking = {
     domain = config.constants.domain;
     firewall = {
-      allowedTCPPorts = with port; [ http https xray ];
-      allowedUDPPorts = with port; [ wireguard-server ];
+      allowedTCPPorts = with config.constants.port; [ http https ];
     };
     hostId = "2cadb253";
-    nat = {
-      enable = true;
-      externalInterface = "ens18";
-      internalInterfaces = [ wgi ];
-    };
     nftables.enable = true;
-    wireguard.interfaces.${wgi} = {
-      ips = [ "10.32.54.76/24" ];
-      listenPort = port.wireguard-server;
-      peers = [
-        {
-          allowedIPs = [ "10.32.54.2/32" ];
-          publicKey = "RhS1H8g47EnOhu1F6y3QO6XqxnabGcNNb0BixBuKkDQ=";
-        }
-        {
-          allowedIPs = [ "10.32.54.3/32" ];
-          publicKey = "1OA03mqu7SxREAum4UabJKD7hf+foPLu1j0E1N5K508=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets."wireguard/${hn}".path;
-    };
   };
 
   services = {
@@ -53,8 +32,5 @@ let hn = config.networking.hostName; port = config.constants.port; wgi = "wgs";
     resolved.enable = true;
   };
 
-  sops.secrets = {
-    "cloudflare/${hn}" = { };
-    "wireguard/${hn}" = { };
-  };
+  sops.secrets."cloudflare/${hn}" = { };
 }

linux/singularity/xray.nix

@@ -1,10 +0,0 @@
-{ config, ... }:
-
-let xrayCfg = "xray/config.json"; in {
-  services.xray = {
-    enable = true;
-    settingsFile = config.sops.secrets.${xrayCfg}.path;
-  };
-
-  sops.secrets.${xrayCfg}.mode = "0444";
-}