1{
 2  den,
 3  lib,
 4  ...
 5}: {
 6  den.aspects.core.tailscale = {
 7    persist = {
 8      directories = [
 9        {
10          directory = "/var/lib/tailscale";
11          mode = "0700";
12        }
13      ];
14    };
15
16    nixos = {
17      host,
18      config,
19      pkgs,
20      ...
21    }: {
22      environment.systemPackages = [pkgs.tailscale];
23
24      services.tailscale = {
25        enable = true;
26        extraUpFlags = [
27          "--login-server=https://gate.trin.one"
28        ];
29      };
30
31      networking.hosts = lib.concatMapAttrs (hostname: {address, ...}:
32        lib.optionalAttrs (hostname != host.name) {
33          ${address.ipv4.tailscale} = [hostname];
34          ${address.ipv6.tailscale} = [hostname];
35        })
36      (lib.mergeAttrsList (lib.attrValues den.hosts));
37
38      networking.firewall = {
39        trustedInterfaces = [config.services.tailscale.interfaceName];
40        allowedUDPPorts = [config.services.tailscale.port];
41      };
42
43      systemd.network.wait-online.enable = false;
44      boot.initrd.systemd.network.wait-online.enable = false;
45    };
46  };
47}