1 files changed, 37 insertions, 3 deletions
diff --git a/os/srv/headscale.nix b/os/srv/headscale.nix
index a650067..01fc06c 100644
--- a/os/srv/headscale.nix
+++ b/os/srv/headscale.nix
@@ -1,14 +1,46 @@
 {
   config,
   lib,
+  pkgs,
   masterDomain,
   ...
 }:
 let
   cfg = config.os.srv.headscale;
+  aclPolicy = pkgs.writeText "headscale-policy.json" (
+    builtins.toJSON {
+      groups = {
+        "group:admin" = [ "your-device-name" ];
+        "group:friends" = [ "friend-device-name" ];
+      };
+
+      hosts = {
+        "server" = "10.4.0.1";
+      };
+
+      acls = [
+        {
+          action = "accept";
+          src = [ "group:admin" ];
+          dst = [ "*:*" ];
+        }
+
+        {
+          action = "accept";
+          src = [ "group:friends" ];
+          dst = [
+            "server:18080"
+            "server:18081"
+            "server:25565"
+          ];
+        }
+      ];
+    }
+  );
 in
 {
   options.os.srv.headscale.enable = lib.mkEnableOption "enables headscales";
+
   config = lib.mkIf cfg.enable {
     services.headscale = {
       enable = true;
@@ -18,14 +50,16 @@ in
       settings = {
         server_url = "https://vpn.${masterDomain}";
 
+        policy.path = "${aclPolicy}";
+
         dns = {
           magic_dns = true;
-          base_domain = "vpn.internal";
-          nameservers = [ "10.255.1.1" ];
+          base_domain = "vpn";
+          nameservers = [ config.os.core.network.ips.vm2-gateway ];
         };
 
         ip_prefixes = [
-          "10.254.0.0/16"
+          "10.4.0.0/16"
         ];
       };
     };