1{lib, ...}: {
 2  den.aspects.services.tailscale-relay = {
 3    settings.host.port = lib.mkOption {
 4      type = lib.types.port;
 5      default = 40000;
 6      description = "UDP port that accepts peer relay connections from tailnet members.";
 7    };
 8
 9    tailscaleGrant = _: [
10      {
11        src = ["autogroup:member"];
12        app."tailscale.com/cap/relay" = [];
13      }
14    ];
15
16    nixos = {host, ...}: let
17      cfg = host.settings.services.tailscale-relay;
18    in {
19      services.tailscale.extraSetFlags = [
20        "--relay-server-port=${toString cfg.port}"
21      ];
22
23      networking.firewall.allowedUDPPorts = [cfg.port];
24    };
25  };
26}