mirror of
https://github.com/NixOS/nixpkgs.git
synced 2024-12-26 23:54:01 +00:00
c9a1647ade
This avoids the scenario where you activate a new config over Tailscale, and a long delay between the "stop services" and "start services" phases of the activation script lead to your terminal freezing for tens of seconds, until tailscaled finally gets started again and the session recovers. Per the documentation of stopIfChanged, this is only safe to do if the service definition is robust to stopping the old process using the new service definition. As the maintainer of the upstream systemd unit, I can confirm that Tailscale is robust to this scenario: it has to be in order to work right on several other distros that just do unpack-then-restart, rather than the more complex stop-unpack-start dance. Signed-off-by: David Anderson <dave@natulte.net>
65 lines
2.2 KiB
Nix
65 lines
2.2 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let cfg = config.services.tailscale;
|
|
in {
|
|
meta.maintainers = with maintainers; [ danderson mbaillie ];
|
|
|
|
options.services.tailscale = {
|
|
enable = mkEnableOption "Tailscale client daemon";
|
|
|
|
port = mkOption {
|
|
type = types.port;
|
|
default = 41641;
|
|
description = "The port to listen on for tunnel traffic (0=autoselect).";
|
|
};
|
|
|
|
interfaceName = mkOption {
|
|
type = types.str;
|
|
default = "tailscale0";
|
|
description = ''The interface name for tunnel traffic. Use "userspace-networking" (beta) to not use TUN.'';
|
|
};
|
|
|
|
permitCertUid = mkOption {
|
|
type = types.nullOr types.nonEmptyStr;
|
|
default = null;
|
|
description = "Username or user ID of the user allowed to to fetch Tailscale TLS certificates for the node.";
|
|
};
|
|
|
|
package = mkOption {
|
|
type = types.package;
|
|
default = pkgs.tailscale;
|
|
defaultText = literalExpression "pkgs.tailscale";
|
|
description = "The package to use for tailscale";
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
environment.systemPackages = [ cfg.package ]; # for the CLI
|
|
systemd.packages = [ cfg.package ];
|
|
systemd.services.tailscaled = {
|
|
wantedBy = [ "multi-user.target" ];
|
|
path = [ pkgs.openresolv pkgs.procps ];
|
|
serviceConfig.Environment = [
|
|
"PORT=${toString cfg.port}"
|
|
''"FLAGS=--tun ${lib.escapeShellArg cfg.interfaceName}"''
|
|
] ++ (lib.optionals (cfg.permitCertUid != null) [
|
|
"TS_PERMIT_CERT_UID=${cfg.permitCertUid}"
|
|
]);
|
|
# Restart tailscaled with a single `systemctl restart` at the
|
|
# end of activation, rather than a `stop` followed by a later
|
|
# `start`. Activation over Tailscale can hang for tens of
|
|
# seconds in the stop+start setup, if the activation script has
|
|
# a significant delay between the stop and start phases
|
|
# (e.g. script blocked on another unit with a slow shutdown).
|
|
#
|
|
# Tailscale is aware of the correctness tradeoff involved, and
|
|
# already makes its upstream systemd unit robust against unit
|
|
# version mismatches on restart for compatibility with other
|
|
# linux distros.
|
|
stopIfChanged = false;
|
|
};
|
|
};
|
|
}
|