infrastructure/nixos/tailscale.nix

{
  config,
  lib,
  pkgs,
  ...
}:
with lib; let
  cfg = config.services.tailscale;
in {
  options.services.tailscale = with types; {
    advertiseExitNode = mkEnableOption "exit node";
  };
  config = {
    networking.firewall = {
      trustedInterfaces = [config.services.tailscale.interfaceName];
      allowedUDPPorts = [config.services.tailscale.port];
    };
    systemd.network = {
      wait-online.ignoredInterfaces = [config.services.tailscale.interfaceName];
      networks."50-tailscale" = {
        networkConfig = {
          DNSDefaultRoute = false;
          #DNS = "";
        };
      };
    };

    services.tailscale.enable = mkDefault true;

    sops.secrets.tailscale-key = mkIf config.services.tailscale.enable { };
    systemd.services.tailscale-autoconnect = mkIf config.services.tailscale.enable rec {
      description = "Automatic connection to Tailscale";

      # make sure tailscale is running before trying to connect to tailscale
      after = wants ++ wantedBy;
      wants = [ "network-pre.target" ];
      wantedBy = [ "tailscaled.service" ];

      # set this service as a oneshot job
      serviceConfig = {
        Type = "oneshot";
      };

      # have the job run this shell script
      script = let
        fixResolved = optionalString config.services.resolved.enable ''
          resolvectl revert ${config.services.tailscale.interfaceName} || false
        '';
        advertiseExitNode = optionalString cfg.advertiseExitNode " --advertise-exit-node";
      in with pkgs; ''
        # wait for tailscaled to settle
        sleep 5

        ${fixResolved}

        # check if we are already authenticated to tailscale
        status="$(${getExe tailscale} status -json | ${getExe jq} -r .BackendState)"
        if [[ $status = Running ]]; then
          # if so, then do nothing
          exit 0
        fi

        # otherwise authenticate with tailscale
        ${getExe tailscale} up${advertiseExitNode} -authkey $(cat ${config.sops.secrets.tailscale-key.path})
      '';
    };
  };
}