server-configuration/README.md

# VPN server configuration

This is an experimental configuration for my Hetzner VPS and Cloudflare to run a VPN using OpenTofu and Nix, based on [NixOS/nixos-wiki-infra on Github](https://github.com/NixOS/nixos-wiki-infra).

## Configure ssh

Add keys to `target/admin/terraform.tf`.

## Configure .env

Copy `.env.example` to `.env` and fill in the values.

### Hetzner

In the Hetzner Cloud dashboard, go to the project and click `Security -> API Tokens`.

### Cloudflare

In the Cloudflare user settings, generate an API token with write access to DNS zones.

## Configure sops

On the Terraform client, run:

```bash
nix develop
cd targets/vpn/secrets
just generate-key
cp secrets.yaml.example secrets.yaml
```

Populate `secrets.yaml` with the desired values. Run `age-keygen` to get another key specifically for the server and put it in `secrets.yaml` (note that this will only work during installation). Then run `just encrypt` to encrypt and `just decrypt` to decrypt. Put the public key for both the VPN server and the OpenTofu client in `.sops.yaml` in the project root directory.

If you have already installed the server without a key, then run on the server:

```bash
sudo mkdir -p /var/lib/secrets
sudo chmod 700 /var/lib/secrets
sudo chown root:root /var/lib/secrets
umask 0177
age-keygen | sudo tee /var/lib/secrets/age >/dev/null
sudo chmod 600 /var/lib/secrets/age
sudo chown root:root /var/lib/secrets/age
umask 0022
cat /var/lib/secrets/age
```

Or run on the client: `nix-shell -p ssh-to-age --run 'ssh-keyscan example.com | ssh-to-age'` to get a public age key from the server's public ssh key.

Then follow the above instructions to add the public key.

## Apply configuration

For cross-compiling on different architectures, you will need to add a builder by visiting the following resources:
- https://nix.dev/tutorials/nixos/distributed-builds-setup.html
- https://nix.dev/manual/nix/2.25/advanced-topics/distributed-builds

Run `nix develop` at the root of the project directory to access a shell where OpenTofu is accessible.

In the `targets` directory, run `just` to update the configurations.

## VPN

To set up the VPN, on the VPS run:

```bash
headscale users create default
headscale preauthkeys create --user default --reusable
```

On the client run:

```bash
tailscale up --login-server <HEADSCALE_URL> --auth-key <KEY>
```

## Troubleshooting

### Hetzner VPN

Some stuff may need to be configured by hand. For instance, the network settings may change with a new installation and need to be updated in `targets/vpn/configuration.nix`, or it may cause the network to be disabled requiring mounting with a NixOS recovery image and using `nixos-enter` to redo the networking and rebuild the system.

It may also complain about a hostname change. Changing the name of the VPN in `terraform/nixos-vpn` from `nixos-vpn` to `vpn` might help but I haven't tested it out yet. Otherwise you may need to clone the repo inside of the VM and do `nixos-rebuild` there.