From 95f5e38198ead72519c88794e4189861cb288899 Mon Sep 17 00:00:00 2001
From: Joao Porta <jpedro.porta@gmail.com>
Date: Sun, 12 Jul 2026 17:03:16 -0300
Subject: [PATCH] tailscale

---
 hosts/jpporta-nixos/configuration.nix         | 21 +++++++++++--
 hosts/writter-deck/home.nix                   |  7 +++++
 .../home-manager/arch-packages/default.nix    |  1 +
 modules/nixos/tailscale/default.nix           | 30 +++++++++++++++++++
 4 files changed, 56 insertions(+), 3 deletions(-)
 create mode 100644 modules/nixos/tailscale/default.nix

diff --git a/hosts/jpporta-nixos/configuration.nix b/hosts/jpporta-nixos/configuration.nix
index aaf4e69..bcc6aa2 100644
--- a/hosts/jpporta-nixos/configuration.nix
+++ b/hosts/jpporta-nixos/configuration.nix
@@ -13,6 +13,7 @@
     ../../modules/nixos/hyprland
     ../../modules/nixos/steam
     ../../modules/nixos/awsvpn
+    ../../modules/nixos/tailscale
   ];
 
   # Bootloader
@@ -113,6 +114,7 @@
   custom = {
     hyprland.enable = true;
     steam.enable = true;
+    tailscale.enable = true;
   };
 
   ##------------------------------
@@ -208,9 +210,22 @@
   programs.awsVpnClient.enable = true;
   programs.dconf.enable = true;
 
-  # OpenSSH
-  services.openssh.enable = true;
-  programs.mosh.enable = true;
+  # OpenSSH: reachable through the trusted Tailscale interface, but not opened
+  # broadly on every network interface by the firewall.
+  services.openssh = {
+    enable = true;
+    openFirewall = false;
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      PermitRootLogin = "no";
+      AllowUsers = [ "jpporta" ];
+    };
+  };
+  programs.mosh = {
+    enable = true;
+    openFirewall = false;
+  };
 
   nixpkgs.config.allowUnfree = true;
   system.stateVersion = "26.05";
diff --git a/hosts/writter-deck/home.nix b/hosts/writter-deck/home.nix
index 5e6bf84..55b0298 100644
--- a/hosts/writter-deck/home.nix
+++ b/hosts/writter-deck/home.nix
@@ -72,6 +72,7 @@ in
     ripgrep
     fd
     mosh
+    tailscale
     fastfetch
     stow
     tmux
@@ -163,6 +164,12 @@ in
         };
 
         "pc" = {
+          hostname = "jpporta-nixos";
+          user = "jpporta";
+          serverAliveInterval = 30;
+        };
+
+        "pc-lan" = {
           hostname = "192.168.0.100";
           user = "jpporta";
           serverAliveInterval = 30;
diff --git a/modules/home-manager/arch-packages/default.nix b/modules/home-manager/arch-packages/default.nix
index 6525104..485d16a 100644
--- a/modules/home-manager/arch-packages/default.nix
+++ b/modules/home-manager/arch-packages/default.nix
@@ -127,6 +127,7 @@ in
     obsidian
     obs-cmd
     qbittorrent
+    liberation_ttf
     zathura
     mpv
     yt-dlp
diff --git a/modules/nixos/tailscale/default.nix b/modules/nixos/tailscale/default.nix
new file mode 100644
index 0000000..4a6c6bc
--- /dev/null
+++ b/modules/nixos/tailscale/default.nix
@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.custom.tailscale;
+in
+{
+  options.custom.tailscale = {
+    enable = lib.mkEnableOption "Tailscale private mesh VPN";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.tailscale.enable = true;
+
+    # Let services bound to this host, like OpenSSH and mosh, be reachable from
+    # trusted devices in the tailnet without exposing them on public interfaces.
+    networking.firewall = {
+      trustedInterfaces = [ "tailscale0" ];
+      checkReversePath = "loose";
+    };
+
+    environment.systemPackages = with pkgs; [
+      tailscale
+    ];
+  };
+}