mirror of
https://github.com/anotherhadi/nixy.git
synced 2026-10-05 19:28:26 +02:00
46 lines
1.2 KiB
Nix
46 lines
1.2 KiB
Nix
# Cloudflared tunnel configuration for NixOS
|
|
# It allows exposing services securely via Cloudflare Tunnel
|
|
{
|
|
config,
|
|
pkgs-unstable,
|
|
...
|
|
}: {
|
|
sops.secrets.cloudflared-token.mode = "0400";
|
|
|
|
# To setup cloudflared, run:
|
|
# - `cloudflared tunnel login`
|
|
# - `cloudflared tunnel create YourTunnelName`
|
|
#
|
|
# This will create a credentials file & give you the tunnel ID to use below.
|
|
services.cloudflared = {
|
|
enable = true;
|
|
tunnels."${config.var.tunnelId}" = {
|
|
credentialsFile = config.sops.secrets."cloudflared-token".path;
|
|
default = "http_status:404";
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = with pkgs-unstable; [
|
|
cloudflared
|
|
];
|
|
|
|
systemd.services."cloudflared-tunnel-${config.var.tunnelId}" = {
|
|
wantedBy = ["multi-user.target"];
|
|
after = ["network-online.target" "adguardhome.service"];
|
|
wants = ["network-online.target"];
|
|
requires = ["adguardhome.service"];
|
|
serviceConfig = {
|
|
Restart = "on-failure";
|
|
RestartSec = "5s";
|
|
StartLimitIntervalSec = 300;
|
|
StartLimitBurst = 10;
|
|
};
|
|
};
|
|
|
|
# At the moment (2025), for support of browser rendering of the tunnels, this line is required:
|
|
services.openssh.settings.Macs = [
|
|
"hmac-sha2-256"
|
|
"hmac-sha2-512"
|
|
];
|
|
}
|