feat: add Tailscale configuration and integrate with headscale login …

provisioning/packages.sls

@@ -15,7 +15,7 @@
 {% set _shell = ['bash-completion', 'screen', 'tmux', 'shellcheck', 'zsh'] %}
 {% set _shell_rhel = (_shell | reject('equalto', 'shellcheck') | list) + ['ShellCheck'] %}
 {% set _build_base = ['autoconf', 'automake', 'cmake'] %}
-{% set _net_base = ['nmap', 'socat', 'tcpdump', 'traceroute'] %}
+{% set _net_base = ['nmap', 'socat', 'tcpdump', 'traceroute', 'tailscale', ''] %}
 {% set _compress_base = ['bzip2', 'zip'] %}
 {% set _vcs_base = ['git-lfs', 'tig'] %}
 {% set _modern_cli_base = ['bat', 'fzf', 'ripgrep'] %}
@@ -179,7 +179,7 @@ windows:
       development: [GitHub.GitHubDesktop, GitHub.cli, Gitleaks.Gitleaks, JetBrains.IntelliJIDEA.Community, Microsoft.VisualStudio.BuildTools, Microsoft.VisualStudio.Community, Microsoft.VisualStudioCode, MSYS2.MSYS2, NSIS.NSIS, Kitware.CMake]
       hardware: [BitSum.ParkControl, BitSum.ProcessLasso, Guru3D.RTSS, TechPowerUp.NVCleanstall, Wagnardsoft.DisplayDriverUninstaller, REALiX.HWiNFO, TechPowerUp.GPU-Z]
       rgb_peripherals: [namazso.PawnIO, Nefarius.HidHide, Olivia.VIA, OpenRGB.OpenRGB, ViGEm.ViGEmBus]
-      networking: [Apple.Bonjour, Insecure.Nmap, SSHFS-Win.SSHFS-Win, WinFsp.WinFsp, WiresharkFoundation.Wireshark]
+      networking: [Apple.Bonjour, Insecure.Nmap, SSHFS-Win.SSHFS-Win, WinFsp.WinFsp, WiresharkFoundation.Wireshark, Tailscale.Tailscale]
       kubernetes: [Kubecolor.kubecolor, Freelensapp.Freelens]
       media_creative: [Audacity.Audacity, Cockos.REAPER, Inkscape.Inkscape, KDE.Krita, rocksdanister.LivelyWallpaper]
       ricing: [Rainmeter.Rainmeter]

srv/pillar/secrets/init.sls.example

@@ -13,6 +13,10 @@ k3s:
 service_user:
   password: "cozy_1234abcd!"
 
+# headscale:
+#   auth-key: "hskey-auth-1234abcd"
+#   login-server: "https://vpn.example.com"
+
 services:
   embedding:
     langcache:

srv/salt/common/init.sls

@@ -7,3 +7,4 @@ include:
   - common.vim
   - common.hosts
   - common.ssh
+  - common.tailscale

srv/salt/common/tailscale.sls

@@ -0,0 +1,22 @@
+# tailscale configuration
+# Connects tailscale to headscale login server using pillar-provided auth key
+# Pillar structure:
+# {# example in srv/pillar/secrets/init.sls.example #}
+#   headscale:
+#     auth-key: "hskey-auth-..."
+#     login-server: "https://headscale.example.com"
+
+{% set headscale = salt['pillar.get']('headscale', {}) %}
+{% set auth_key = headscale.get('auth-key', '') %}
+{% set login_server = headscale.get('login-server', '') %}
+
+{% if auth_key and login_server %}
+tailscale_up:
+  cmd.run:
+    - name: tailscale up --login-server {{ login_server }} --authkey {{ auth_key }}
+    - unless: tailscale status
+{% else %}
+tailscale_up_skipped:
+  test.noop:
+    - name: headscale pillar not configured, skipping tailscale up
+{% endif %}