1{
 2  den,
 3  lib,
 4  ...
 5}: {
 6  den.aspects.core.includes = [den.aspects.core.tailscale];
 7  den.aspects.core.tailscale = {
 8    persist = {
 9      directories = [
10        {
11          directory = "/var/lib/tailscale";
12          mode = "0700";
13        }
14      ];
15    };
16
17    nixos = {
18      host,
19      config,
20      pkgs,
21      ...
22    }: {
23      environment.systemPackages = [pkgs.tailscale];
24
25      services.tailscale = {
26        enable = true;
27        extraUpFlags = [
28          "--login-server=https://gate.trin.one"
29        ];
30      };
31
32      networking.hosts = lib.concatMapAttrs (hostname: {address, ...}:
33        lib.optionalAttrs (hostname != host.name) {
34          ${address.ipv4.tailscale} = [hostname];
35          ${address.ipv6.tailscale} = [hostname];
36        })
37      (lib.mergeAttrsList (lib.attrValues den.hosts));
38
39      networking.firewall = {
40        trustedInterfaces = [config.services.tailscale.interfaceName];
41        allowedUDPPorts = [config.services.tailscale.port];
42      };
43
44      systemd.network.wait-online.enable = false;
45      boot.initrd.systemd.network.wait-online.enable = false;
46    };
47  };
48}