Merge branch 'master' of ssh://git.joshuabell.xyz:3032/ringofstorms/dotfiles

flakes/common/nix_modules/tailnet/default.nix

@@ -11,11 +11,19 @@ let
       secrets = config.age.secrets or { };
     in
     secrets ? ${secret} && secrets.${secret} != null;
+
+  # Shared DNS records for h001 services - used for /etc/hosts fallback
+  h001Dns = import ./h001_dns.nix;
 in
 {
   environment.systemPackages = with pkgs; [ tailscale ];
   boot.kernelModules = [ "tun" ];
 
+  # Add /etc/hosts entries for h001 services as fallback for headscale DNS
+  networking.hosts = {
+    "${h001Dns.ip}" = map (name: "${name}.${h001Dns.baseDomain}") h001Dns.subdomains;
+  };
+
   services.tailscale = {
     enable = true;
     openFirewall = true;

flakes/common/nix_modules/tailnet/h001_dns.nix

@@ -0,0 +1,27 @@
+# Shared DNS records for h001 services
+# Used by headscale for DNS splitting and by other hosts for /etc/hosts fallback
+{
+  # h001's tailscale IP
+  ip = "100.64.0.13";
+
+  # List of subdomain names that point to h001
+  subdomains = [
+    "jellyfin"
+    "media"
+    "notes"
+    "chat"
+    "sso-proxy"
+    "n8n"
+    "sec"
+    "sso"
+    "gist"
+    "git"
+    "blog"
+    "etebase"
+    "photos"
+    "location"
+  ];
+
+  # Base domain
+  baseDomain = "joshuabell.xyz";
+}

hosts/linode/l001/flake.lock

@@ -3,11 +3,11 @@
     "common": {
       "locked": {
         "dir": "flakes/common",
-        "lastModified": 1766036507,
+        "lastModified": 1770664771,
-        "narHash": "sha256-ZFJjJVkWlefIhsJ2vHniBnqqnTCa9qGW3pQOXUU4X1I=",
+        "narHash": "sha256-8X1QU1bmy0hQe2PnpVcg1trna4BO+bpTpC79mWsz1rY=",
         "ref": "refs/heads/master",
-        "rev": "fca1bd9d8f4d7e345b373f69c9d2b40d9fa33f59",
+        "rev": "94249e7bcbfed6a04baa01972661bd1901a95f68",
-        "revCount": 952,
+        "revCount": 1248,
         "type": "git",
         "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
       },

hosts/linode/l001/headscale.nix

@@ -1,4 +1,7 @@
 { pkgs, ... }:
+let
+  h001Dns = import ../../../flakes/common/nix_modules/tailnet/h001_dns.nix;
+in
 {
   config = {
     # TODO backup /var/lib/headscale data
@@ -17,40 +20,11 @@
           magic_dns = true;
           base_domain = "net.joshuabell.xyz";
           override_local_dns = false;
-          # nameservers.global = [
+          extra_records = map (name: {
-          #   "1.1.1.1"
-          #   "1.0.0.1"
-          #   "8.8.8.8"
-          #   "8.8.4.4"
-          #   "9.9.9.9"
-          #   "9.9.9.10"
-          # ];
-          extra_records =
-            let
-              # DNS splitting at the tailscale network level. We intercept these domains
-              # when connected to tailscale and skip my global/internet facing DNS proxy
-              h001ARecord = name: {
             type = "A";
-                name = "${name}.joshuabell.xyz";
+            name = "${name}.${h001Dns.baseDomain}";
-                value = "100.64.0.13";
+            value = h001Dns.ip;
-              };
+          }) h001Dns.subdomains;
-            in
-            [
-              (h001ARecord "jellyfin")
-              (h001ARecord "media")
-              (h001ARecord "notes")
-              (h001ARecord "chat")
-              (h001ARecord "sso-proxy")
-              (h001ARecord "n8n")
-              (h001ARecord "sec")
-              (h001ARecord "sso")
-              (h001ARecord "gist")
-              (h001ARecord "git")
-              (h001ARecord "blog")
-              (h001ARecord "etebase")
-              (h001ARecord "photos")
-              (h001ARecord "location")
-            ];
         };
       };
     };

hosts/lio/flake.lock

@@ -64,11 +64,11 @@
     "common": {
       "locked": {
         "dir": "flakes/common",
-        "lastModified": 1770613864,
+        "lastModified": 1770664771,
-        "narHash": "sha256-Wn/dJdzToNfAqrZp1oRbXTvcF88UUCYkfOBPLsHpHNY=",
+        "narHash": "sha256-8X1QU1bmy0hQe2PnpVcg1trna4BO+bpTpC79mWsz1rY=",
         "ref": "refs/heads/master",
-        "rev": "9e5e3cd4fa9ddae4ede2ba6c83f3c734a33f27b4",
+        "rev": "94249e7bcbfed6a04baa01972661bd1901a95f68",
-        "revCount": 1240,
+        "revCount": 1248,
         "type": "git",
         "url": "https://git.joshuabell.xyz/ringofstorms/dotfiles"
       },