{ config, pkgs, ... }: { environment.systemPackages = [pkgs.tailscale]; services.tailscale.enable = true; networking.firewall = { enable = true; trustedInterfaces = ["tailscale0"]; allowedUDPPorts = [config.services.tailscale.port]; allowedTCPPorts = [22]; # https://github.com/tailscale/tailscale/issues/4432 checkReversePath = "loose"; }; networking.networkmanager.unmanaged = ["tailscale0"]; networking.nameservers = [ "100.100.100.100" "1.1.1.1" "9.9.9.9" ]; # create a oneshot job to authenticate to Tailscale systemd.services.tailscale-autoconnect = { description = "Automatic connection to Tailscale"; # make sure tailscale is running before trying to connect to tailscale after = ["network-pre.target" "tailscale.service"]; wants = ["network-pre.target" "tailscale.service"]; wantedBy = ["multi-user.target"]; # set this service as a oneshot job serviceConfig.Type = "oneshot"; # have the job run this shell script script = with pkgs; '' # wait for tailscaled to settle sleep 2 # check if we are already authenticated to tailscale status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)" if [ $status = "Running" ]; then # if so, then do nothing exit 0 fi # otherwise authenticate with tailscale ${tailscale}/bin/tailscale up -authkey tskey-PASTE-ONE-SHOT-KEY ''; }; }