1{
 2  den.aspects.services.headscale.policy = {
 3    nixos = {
 4      tailscaleGrant,
 5      reverseProxy,
 6      pkgs,
 7      lib,
 8      ...
 9    }: let
10      inherit
11        (import ./_lib.nix {inherit lib;})
12        mkCaddyGrants
13        mkDirectDnsGrants
14        mkPolicyGrants
15        ;
16    in {
17      services.headscale.settings.policy.path =
18        pkgs.writeText "headscale-policy.json"
19        (builtins.toJSON {
20          grants = mkPolicyGrants tailscaleGrant ++ mkCaddyGrants reverseProxy ++ mkDirectDnsGrants reverseProxy;
21        });
22    };
23  };
24}