fix(tailscale): open Tailscale's WireGuard port in the firewall

services.tailscale.openFirewall defaults to false while the NixOS firewall is enabled, so argon, krypton and neon dropped unsolicited inbound 41641/udp. Direct connections then only succeed if the other peer accepts inbound; between two of these hosts (or a host and a phone) traffic can fall back to a DERP relay. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merge pull request 'feature(git): enable git lfs for my user' (#108 ) from feature/add_tea into main
2026-10-20 12:48:41 +02:00 · 2026-10-18 14:43:17 +02:00 · 2026-10-18 14:42:07 +02:00 · 2026-10-18 14:16:55 +02:00 · 2026-10-18 14:15:52 +02:00 · 2026-10-16 20:14:45 +02:00
5 changed files with 10 additions and 3 deletions
@@ -10,12 +10,13 @@
    ../../modules/nixos/bootloader.nix
    ../../modules/nixos/certificates.nix
    ../../modules/nixos/data-drives.nix
    ../../modules/nixos/docker.nix
    ../../modules/nixos/gnupg.nix
    ../../modules/nixos/noctalia-greeter.nix
    ../../modules/nixos/lanzaboote.nix
    ../../modules/nixos/locales.nix
    ../../modules/nixos/networking.nix
    ../../modules/nixos/niri.nix
    ../../modules/nixos/noctalia-greeter.nix
    ../../modules/nixos/noctalia.nix
    ../../modules/nixos/openssh.nix
    ../../modules/nixos/packages.nix
@@ -24,6 +24,7 @@ in
  programs.git = {
    enable = true;
    lfs.enable = true;
    settings = {
      push.autoSetupRemote = true;
      user = {
@@ -8,6 +8,7 @@
    fastfetch
    keepassxc
    signal-desktop
    tea
    teamspeak6-client
    typst
    zathura
@@ -4,6 +4,10 @@
    tuned.enable = true;
    upower.enable = true;
    fwupd.enable = true;
-    tailscale.enable = true;
+    tailscale = {
      enable = true;
      # inbound 41641/udp so peers can connect directly instead of via DERP
      openFirewall = true;
    };
  };
 }
Author	SHA1	Message	Date
aaronandClaude Opus 5.5	fb3e2864d6	fix(tailscale): open Tailscale's WireGuard port in the firewall services.tailscale.openFirewall defaults to false while the NixOS firewall is enabled, so argon, krypton and neon dropped unsolicited inbound 41641/udp. Direct connections then only succeed if the other peer accepts inbound; between two of these hosts (or a host and a phone) traffic can fall back to a DERP relay. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-20 12:48:41 +02:00
aaron	8701507742	Merge pull request 'feature(git): enable git lfs for my user' (#108 ) from feature/add_tea into main Reviewed-on: #108	2026-10-18 14:43:17 +02:00
aaron	c748f22033	feature(git): enable git lfs for my user	2026-10-18 14:42:07 +02:00
aaron	a9e17a8c35	Merge pull request 'feature(programs): add the tea binary to my user to communicate with my gitea server' (#107 ) from feature/add_tea into main Reviewed-on: #107	2026-10-18 14:16:55 +02:00
aaron	69adfc9890	feature(programs): add the tea binary to my user to communicate with my gitea server	2026-10-18 14:15:52 +02:00
aaron	c9c15addcc	Merge pull request 'feature(argon): add rootless docker to argon' (#106 ) from feature/docker_on_argon into main Reviewed-on: #106	2026-10-16 20:14:45 +02:00
aaron	abe6fd5c18	feature(argon): add rootless docker to argon	2026-10-16 20:06:09 +02:00
aaron	49a8b574bf	Merge pull request 'feature: add de_nodeadkeys to niri-greet as well' (#105 ) from feature/nodeadkeys into main Reviewed-on: #105	2026-10-15 21:00:16 +02:00
aaron	ff7b34fedd	Merge pull request 'feature(niri): change keyboard layout to the nondeadkeys variant' (#104 ) from feature/nodeadkeys into main Reviewed-on: #104	2026-10-15 18:47:29 +02:00