Commit 23f8d16

@@ -59,7 +59,8 @@ in {
     nixos = {host, ...}: {
       services.openssh = {
         enable = host.settings.core.openssh.server.enable;
-        ports = [host.settings.core.openssh.server.port];
+        # Serve on 22 port for Tailscale
+        ports = lib.unique [22 host.settings.core.openssh.server.port];
         generateHostKeys = true;
         inherit hostKeys;
         settings = {

@@ -0,0 +1,48 @@
+{
+  den,
+  lib,
+  ...
+}: {
+  den.aspects.core.includes = [den.aspects.core.tailscale];
+  den.aspects.core.tailscale = {
+    persist = {
+      directories = [
+        {
+          directory = "/var/lib/tailscale";
+          mode = "0700";
+        }
+      ];
+    };
+
+    nixos = {
+      host,
+      config,
+      pkgs,
+      ...
+    }: {
+      environment.systemPackages = [pkgs.tailscale];
+
+      services.tailscale = {
+        enable = true;
+        extraUpFlags = [
+          "--login-server=https://gate.trin.one"
+        ];
+      };
+
+      networking.hosts = lib.concatMapAttrs (hostname: {address, ...}:
+        lib.optionalAttrs (hostname != host.name) {
+          ${address.ipv4.tailscale} = [hostname];
+          ${address.ipv6.tailscale} = [hostname];
+        })
+      (lib.mergeAttrsList (lib.attrValues den.hosts));
+
+      networking.firewall = {
+        trustedInterfaces = [config.services.tailscale.interfaceName];
+        allowedUDPPorts = [config.services.tailscale.port];
+      };
+
+      systemd.network.wait-online.enable = false;
+      boot.initrd.systemd.network.wait-online.enable = false;
+    };
+  };
+}

@@ -9,6 +9,8 @@
         name = "host-ipv6-cyrene";
         file = ./ipv6.age;
       };
+      ipv4.tailscale = "100.65.34.97";
+      ipv6.tailscale = "fd7a:115c:a1e0:1bef:f9f:bba0:707b:d238";
     };
   };
 

@@ -5,6 +5,8 @@
         name = "host-ipv4-hyacine";
         file = ./ipv4.age;
       };
+      ipv4.tailscale = "100.81.111.146";
+      ipv6.tailscale = "fd7a:115c:a1e0:77b2:8216:b5d3:7144:9abe";
     };
   };
 

@@ -1,4 +1,11 @@
 {
+  den.hosts.kevin = {
+    address = {
+      ipv4.tailscale = "100.119.83.79";
+      ipv6.tailscale = "fd7a:115c:a1e0:cdc1:45b1:c962:aac4:e0dc";
+    };
+  };
+
   den.aspects.kevin = {
     nixos = {
       networking.networkmanager.enable = true;

@@ -1,4 +1,11 @@
 {
+  den.hosts.mobius = {
+    address = {
+      ipv4.tailscale = "100.83.181.200";
+      ipv6.tailscale = "fd7a:115c:a1e0:7f0d:51d5:1a0c:a6a9:2104";
+    };
+  };
+
   den.aspects.mobius = {
     nixos = {
       networking.networkmanager.enable = true;

@@ -1,4 +1,11 @@
 {
+  den.hosts.tribios = {
+    address = {
+      ipv4.tailscale = "100.127.6.231";
+      ipv6.tailscale = "fd7a:115c:a1e0:675d:6820:4fa0:fddc:a59";
+    };
+  };
+
   den.aspects.tribios = {
     nixos = {
       boot.kernel.sysctl = {

@@ -20,6 +20,11 @@
               default = null;
             };
           };
+          tailscale = lib.mkOption {
+            description = "Clear text of tailscale IPv${toString ver} address for this host.";
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
         };
       in {
         ipv4 = ipvXOptions 4;