1{den, ...}: {
 2  den.aspects.services.tailscale-nginx-auth = {
 3    includes = [den.aspects.core.tailscale];
 4
 5    nixos = {pkgs, ...}: {
 6      systemd.sockets.tailscale-nginx-auth = {
 7        description = "Tailscale NGINX Authentication socket";
 8        partOf = ["tailscale-nginx-auth.service"];
 9        wantedBy = ["sockets.target"];
10        listenStreams = ["/run/tailscale.nginx-auth.sock"];
11      };
12
13      systemd.services.tailscale-nginx-auth = {
14        description = "Tailscale NGINX Authentication service";
15        requires = ["tailscale-nginx-auth.socket"];
16        after = ["tailscaled.service"];
17
18        serviceConfig = {
19          ExecStart = "${pkgs.tailscale-nginx-auth}/bin/tailscale.nginx-auth";
20          DynamicUser = true;
21          BindPaths = ["/run/tailscale/tailscaled.sock"];
22          PrivateDevices = true;
23          ProtectHome = true;
24          RestrictAddressFamilies = ["AF_UNIX"];
25          Restart = "on-failure";
26        };
27      };
28    };
29  };
30}