jan/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tailscale: Update config

Browse source
This commit is contained in:
Jan Kremer 2026-01-23 09:25:22 +01:00
parent 98fd6d9fb1
commit 390457ae1f
No known key found for this signature in database
3 changed files with 24 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

25
modules/nixos/tailscale.nix
View file

@ -1,3 +1,4 @@
{ config, ... }:
{
services.tailscale = {
enable = true;
@ -5,5 +6,27 @@
extraUpFlags = [ "--ssh" ];
};
networking.firewall.checkReversePath = "loose";
networking = {
nftables.enable = true;
firewall = {
enable = true;
# Always allow traffic from your Tailscale network
trustedInterfaces = [ "${config.services.tailscale.interfaceName}" ];
# Allow the Tailscale UDP port through the firewall
allowedUDPPorts = [ config.services.tailscale.port ];
checkReversePath = "loose";
};
};
# 2. Force tailscaled to use nftables (Critical for clean nftables-only systems)
# This avoids the "iptables-compat" translation layer issues.
systemd.services.tailscaled.serviceConfig.Environment = [
"TS_DEBUG_FIREWALL_MODE=nftables"
];
# 3. Optimization: Prevent systemd from waiting for network online
# (Optional but recommended for faster boot with VPNs)
# systemd.network.wait-online.enable = false;
# boot.initrd.systemd.network.wait-online.enable = false;
systemd.network.wait-online.ignoredInterfaces = [ "${config.services.tailscale.interfaceName}" ];
}