70 lines
2.2 KiB
Nix
70 lines
2.2 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
# Cloudflare tunnel definitions
|
|
tunnels = {
|
|
warp = {
|
|
remoteHost = "warp.ftl.host"; # Cloudflare hostname
|
|
remoteTarget = "localhost:22"; # Where traffic routes to
|
|
localBindPort = 4401; # Local port exposed by cloudflared
|
|
logDir = "/var/lib/cloudflared"; # Directory for logs
|
|
};
|
|
};
|
|
in {
|
|
# Install cloudflared
|
|
environment.systemPackages = with pkgs; [ cloudflared ];
|
|
|
|
# Define cloudflared user and group at the top level
|
|
users.users.cloudflared = {
|
|
isSystemUser = true;
|
|
group = "cloudflared";
|
|
description = "Cloudflared service user";
|
|
home = "/var/lib/cloudflared";
|
|
createHome = true;
|
|
};
|
|
|
|
users.groups.cloudflared = {};
|
|
|
|
# Ensure /var/lib/cloudflared exists with proper permissions
|
|
systemd.tmpfiles.rules = [
|
|
"d /var/lib/cloudflared 0755 cloudflared cloudflared -"
|
|
];
|
|
|
|
# Systemd services per tunnel
|
|
systemd.services = lib.mapAttrs (name: tunnel: {
|
|
description = "Cloudflared Access TCP Tunnel for ${tunnel.remoteHost}";
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
serviceConfig = {
|
|
# The key setting to ensure the service stays running
|
|
Type = "simple";
|
|
ExecStart = "${pkgs.cloudflared}/bin/cloudflared access tcp --hostname ${tunnel.remoteHost} --url ${tunnel.remoteTarget} --port ${toString tunnel.localBindPort} --logfile ${tunnel.logDir}/${name}.log";
|
|
|
|
# Automatic restart
|
|
Restart = "always";
|
|
RestartSec = "5s";
|
|
|
|
# Run as cloudflared user
|
|
User = "cloudflared";
|
|
Group = "cloudflared";
|
|
|
|
# Standard outputs
|
|
StandardOutput = "journal";
|
|
StandardError = "journal";
|
|
};
|
|
}) tunnels;
|
|
|
|
# Documentation metadata
|
|
meta.doc = ''
|
|
This module defines persistent cloudflared TCP tunnels using access tcp.
|
|
Add tunnels by appending to the `tunnels` attribute set.
|
|
|
|
Required keys:
|
|
- remoteHost: The public hostname exposed via Cloudflare Tunnel.
|
|
- remoteTarget: The internal service to forward traffic to (e.g. localhost:22).
|
|
- localBindPort: The port to expose locally (e.g. 4401).
|
|
- logDir: Directory path for log files.
|
|
'';
|
|
}
|