tailscale

hosts/jpporta-nixos/configuration.nix

@@ -13,6 +13,7 @@
     ../../modules/nixos/hyprland
     ../../modules/nixos/steam
     ../../modules/nixos/awsvpn
+    ../../modules/nixos/tailscale
   ];
 
   # Bootloader
@@ -113,6 +114,7 @@
   custom = {
     hyprland.enable = true;
     steam.enable = true;
+    tailscale.enable = true;
   };
 
   ##------------------------------
@@ -208,9 +210,22 @@
   programs.awsVpnClient.enable = true;
   programs.dconf.enable = true;
 
-  # OpenSSH
+  # OpenSSH: reachable through the trusted Tailscale interface, but not opened
-  services.openssh.enable = true;
+  # broadly on every network interface by the firewall.
-  programs.mosh.enable = true;
+  services.openssh = {
+    enable = true;
+    openFirewall = false;
+    settings = {
+      PasswordAuthentication = false;
+      KbdInteractiveAuthentication = false;
+      PermitRootLogin = "no";
+      AllowUsers = [ "jpporta" ];
+    };
+  };
+  programs.mosh = {
+    enable = true;
+    openFirewall = false;
+  };
 
   nixpkgs.config.allowUnfree = true;
   system.stateVersion = "26.05";

hosts/writter-deck/home.nix

@@ -72,6 +72,7 @@ in
     ripgrep
     fd
     mosh
+    tailscale
     fastfetch
     stow
     tmux
@@ -163,6 +164,12 @@ in
         };
 
         "pc" = {
+          hostname = "jpporta-nixos";
+          user = "jpporta";
+          serverAliveInterval = 30;
+        };
+
+        "pc-lan" = {
           hostname = "192.168.0.100";
           user = "jpporta";
           serverAliveInterval = 30;

modules/home-manager/arch-packages/default.nix

@@ -127,6 +127,7 @@ in
     obsidian
     obs-cmd
     qbittorrent
+    liberation_ttf
     zathura
     mpv
     yt-dlp

modules/nixos/tailscale/default.nix

@@ -0,0 +1,30 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.custom.tailscale;
+in
+{
+  options.custom.tailscale = {
+    enable = lib.mkEnableOption "Tailscale private mesh VPN";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.tailscale.enable = true;
+
+    # Let services bound to this host, like OpenSSH and mosh, be reachable from
+    # trusted devices in the tailnet without exposing them on public interfaces.
+    networking.firewall = {
+      trustedInterfaces = [ "tailscale0" ];
+      checkReversePath = "loose";
+    };
+
+    environment.systemPackages = with pkgs; [
+      tailscale
+    ];
+  };
+}