From c36dfec8acc29e1cc12be25ce9e98d889d3b2e17 Mon Sep 17 00:00:00 2001
From: Jordan Holt <jordan@vimium.com>
Date: Thu, 31 Jul 2025 21:59:59 +0100
Subject: [PATCH] hosts/vps2: init

---
 flake.lock                            |  8 ++--
 flake.nix                             |  1 +
 hosts/vps2/default.nix                | 31 +++++++++++++++
 hosts/vps2/disko-config.nix           | 55 +++++++++++++++++++++++++++
 hosts/vps2/hardware-configuration.nix | 29 ++++++++++++++
 modules/nixos/services/tailscale.nix  | 11 +++++-
 6 files changed, 130 insertions(+), 5 deletions(-)
 create mode 100644 hosts/vps2/default.nix
 create mode 100644 hosts/vps2/disko-config.nix
 create mode 100644 hosts/vps2/hardware-configuration.nix

diff --git a/flake.lock b/flake.lock
index 721518d..5c12695 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1000,11 +1000,11 @@
     "secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1752936308,
-        "narHash": "sha256-OAlj8oJpcKo9cCIwxzMolnwdfczlovvC1y1MeIpDPYM=",
+        "lastModified": 1753994653,
+        "narHash": "sha256-kVd17w6oo9dbZfgZXMMPEssspp8vAr32G5U8VnfuIFc=",
         "ref": "refs/heads/master",
-        "rev": "eddee7a0b83063ba60c0dd49fc18399b6564559d",
-        "revCount": 36,
+        "rev": "e0cb8c5b8de3f61fbef13c80219715f2e3e5ffb5",
+        "revCount": 39,
         "type": "git",
         "url": "ssh://git@git.vimium.com/jordan/nix-secrets.git"
       },
diff --git a/flake.nix b/flake.nix
index a7d0976..b6c42a7 100644
--- a/flake.nix
+++ b/flake.nix
@@ -163,6 +163,7 @@
           "pi"
           "skycam"
           "vps1"
+          "vps2"
         ] mkDeployNode;
       };
     };
diff --git a/hosts/vps2/default.nix b/hosts/vps2/default.nix
new file mode 100644
index 0000000..e1ce65e
--- /dev/null
+++ b/hosts/vps2/default.nix
@@ -0,0 +1,31 @@
+{
+  inputs,
+  ...
+}:
+
+{
+  imports = [
+    inputs.disko.nixosModules.disko
+    ./hardware-configuration.nix
+    ./disko-config.nix
+    ../server.nix
+  ];
+
+  nixpkgs = {
+    hostPlatform = "x86_64-linux";
+  };
+
+  networking = {
+    hostId = "60de4af8";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [
+        22 # SSH
+      ];
+    };
+  };
+
+  modules.services.tailscale.isExitNode = true;
+
+  system.stateVersion = "25.05";
+}
diff --git a/hosts/vps2/disko-config.nix b/hosts/vps2/disko-config.nix
new file mode 100644
index 0000000..f5c34d8
--- /dev/null
+++ b/hosts/vps2/disko-config.nix
@@ -0,0 +1,55 @@
+{ lib, ... }:
+{
+  disko.devices = {
+    disk.disk1 = {
+      device = lib.mkDefault "/dev/sda";
+      type = "disk";
+      content = {
+        type = "gpt";
+        partitions = {
+          boot = {
+            name = "boot";
+            size = "2M";
+            type = "EF02";
+          };
+          esp = {
+            name = "ESP";
+            size = "300M";
+            type = "EF00";
+            content = {
+              type = "filesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+            };
+          };
+          root = {
+            name = "root";
+            size = "100%";
+            content = {
+              type = "lvm_pv";
+              vg = "pool";
+            };
+          };
+        };
+      };
+    };
+    lvm_vg = {
+      pool = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "100%FREE";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [
+                "defaults"
+              ];
+            };
+          };
+        };
+      };
+    };
+  };
+}
diff --git a/hosts/vps2/hardware-configuration.nix b/hosts/vps2/hardware-configuration.nix
new file mode 100644
index 0000000..3a85961
--- /dev/null
+++ b/hosts/vps2/hardware-configuration.nix
@@ -0,0 +1,29 @@
+{
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot = {
+    initrd = {
+      availableKernelModules = [
+        "ata_piix"
+        "uhci_hcd"
+        "xen_blkfront"
+        "vmw_pvscsi"
+      ];
+      kernelModules = [ "nvme" ];
+    };
+    loader.grub = {
+      efiSupport = true;
+      efiInstallAsRemovable = true;
+    };
+    tmp.cleanOnBoot = true;
+  };
+
+  zramSwap.enable = true;
+}
diff --git a/modules/nixos/services/tailscale.nix b/modules/nixos/services/tailscale.nix
index 2b11971..e28e8cd 100644
--- a/modules/nixos/services/tailscale.nix
+++ b/modules/nixos/services/tailscale.nix
@@ -17,6 +17,14 @@ in
       default = false;
       example = true;
     };
+    isExitNode = lib.mkOption {
+      default = false;
+      example = true;
+    };
+    useExitNode = lib.mkOption {
+      default = false;
+      example = true;
+    };
     restrictSSH = lib.mkOption {
       default = true;
       example = true;
@@ -37,7 +45,8 @@ in
       extraUpFlags = [
         "--login-server"
         headscale
-      ];
+      ]
+      ++ (if cfg.isExitNode then [ "--advertise-exit-node" ] else [ ]);
     };
 
     services.openssh.openFirewall = !cfg.restrictSSH;