tailscale: silence logs on some machines

hosts/fra1-a/configuration.nix

@@ -45,6 +45,10 @@
     services = {
       node_exporter.enable = true;
       sshguard.enable = true;
+      tailscale = {
+        enable = true;
+        silenceLogs = true;
+      };
 
       postfix = {
         enable = true;
@@ -74,8 +78,6 @@
     };
   };
 
-  services.tailscale.enable = true;
-
   services.nsd = {
     enable = true;
     interfaces = ["0.0.0.0" "::"];

hosts/fwminex/configuration.nix

@@ -74,7 +74,11 @@
 
     services = {
       node_exporter.enable = true;
-      sshguard.enable = true;
+      sshguard.enable = false;
+      tailscale = {
+        enable = true;
+        silenceLogs = true;
+      };
 
       deployerbot = {
         follower = {
@@ -99,7 +103,6 @@
   };
 
   services = {
-    tailscale.enable = true;
 
     xserver = {
       enable = true;

hosts/vno1-oh2/configuration.nix

@@ -155,11 +155,9 @@
           ];
         }
       ];
-
+      tailscale.enable = true;
       node_exporter.enable = true;
-
       gitea.enable = true;
-
       snmp_exporter.enable = true;
       sshguard.enable = true;
 
@@ -232,8 +230,6 @@
   };
 
   services = {
-    tailscale.enable = true;
-
     caddy = {
       enable = true;
       email = "motiejus+acme@jakstys.lt";

hosts/vno3-rp3b/configuration.nix

@@ -62,6 +62,10 @@
     services = {
       node_exporter.enable = true;
       sshguard.enable = true;
+      tailscale = {
+        enable = true;
+        silenceLogs = true;
+      };
 
       borgstor = {
         enable = true;
@@ -92,8 +96,6 @@
     };
   };
 
-  services.tailscale.enable = true;
-
   services.journald.extraConfig = "Storage=volatile";
 
   environment.etc = {

modules/base/default.nix

@@ -154,7 +154,6 @@
     };
 
     networking.firewall.logRefusedConnections = false;
-    networking.firewall.checkReversePath = "loose"; # for tailscale
 
     services = {
       chrony = {

modules/services/default.nix

@@ -1,7 +1,7 @@
 {
   config,
-  lib,
-  pkgs,
+lib,
+pkgs,
   ...
 }: {
   imports = [
@@ -18,6 +18,7 @@
     ./snmp_exporter
     ./sshguard
     ./syncthing
+    ./tailscale
     ./zfsunlock
   ];
 }

modules/services/tailscale/default.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  pkgs,
+  myData,
+  ...
+}: {
+  options.mj.services.tailscale = with lib.types; {
+    enable = lib.mkEnableOption "Enable tailscale";
+    # https://github.com/tailscale/tailscale/issues/1548
+    silenceLogs = lib.mkOption {
+      type = bool;
+      default = false;
+    };
+  };
+
+  config = with config.mj.services.tailscale;
+    lib.mkIf enable {
+      services.tailscale.enable = true;
+      networking.firewall.checkReversePath = "loose"; # for tailscale
+    }
+    // lib.mkIf silenceLogs {
+      systemd.services.tailscale.serviceConfig."StandardOutput" = "null";
+    };
+}