From 8245d0f82efd34c13a7fb5c42766806878cc5ba4 Mon Sep 17 00:00:00 2001
From: Richie Cahill <Richie@tmmworkshop.com>
Date: Tue, 25 Aug 2026 21:19:01 -0400
Subject: [PATCH] feat(tailscale): enable mesh networking across NixOS hosts

- enable Tailscale on Bob, Brain, Jeeves, and Rhapsody
- configure the Jeeves binary cache through Tailscale MagicDNS
- trust the existing workshop cache signing key
---
 common/optional/tailscale.nix         | 6 ++++++
 systems/bob/default.nix               | 1 +
 systems/brain/default.nix             | 1 +
 systems/jeeves/default.nix            | 1 +
 systems/portal-1/default.nix          | 2 +-
 systems/rhapsody-in-green/default.nix | 1 +
 6 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/common/optional/tailscale.nix b/common/optional/tailscale.nix
index 31528ec..3242c64 100644
--- a/common/optional/tailscale.nix
+++ b/common/optional/tailscale.nix
@@ -6,6 +6,12 @@
 {
   networking.firewall.trustedInterfaces = [ "tailscale0" ];
 
+  nix.settings = {
+    trusted-substituters = [ "http://jeeves:5000" ];
+    substituters = [ "http://jeeves:5000/?priority=1&want-mass-query=true" ];
+    trusted-public-keys = [ "cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA=" ];
+  };
+
   services.tailscale = {
     enable = true;
     openFirewall = true;
diff --git a/systems/bob/default.nix b/systems/bob/default.nix
index d404652..5f237cf 100644
--- a/systems/bob/default.nix
+++ b/systems/bob/default.nix
@@ -12,6 +12,7 @@
     "${inputs.self}/common/optional/steam.nix"
     "${inputs.self}/common/optional/syncthing_base.nix"
     "${inputs.self}/common/optional/systemd-boot.nix"
+    "${inputs.self}/common/optional/tailscale.nix"
     "${inputs.self}/common/optional/update.nix"
     "${inputs.self}/common/optional/yubikey.nix"
     "${inputs.self}/common/optional/zerotier.nix"
diff --git a/systems/brain/default.nix b/systems/brain/default.nix
index 4033ade..d63847f 100644
--- a/systems/brain/default.nix
+++ b/systems/brain/default.nix
@@ -7,6 +7,7 @@
     "${inputs.self}/common/optional/ssh_decrypt.nix"
     "${inputs.self}/common/optional/syncthing_base.nix"
     "${inputs.self}/common/optional/systemd-boot.nix"
+    "${inputs.self}/common/optional/tailscale.nix"
     "${inputs.self}/common/optional/update.nix"
     "${inputs.self}/common/optional/zerotier.nix"
     "${inputs.self}/common/optional/zfs"
diff --git a/systems/jeeves/default.nix b/systems/jeeves/default.nix
index a7f6697..8f694bb 100644
--- a/systems/jeeves/default.nix
+++ b/systems/jeeves/default.nix
@@ -13,6 +13,7 @@ in
     "${inputs.self}/common/optional/monitoring-agent.nix"
     "${inputs.self}/common/optional/ssh_decrypt.nix"
     "${inputs.self}/common/optional/syncthing_base.nix"
+    "${inputs.self}/common/optional/tailscale.nix"
     "${inputs.self}/common/optional/update.nix"
     "${inputs.self}/common/optional/zerotier.nix"
     "${inputs.self}/common/optional/zfs"
diff --git a/systems/portal-1/default.nix b/systems/portal-1/default.nix
index 3231c6e..a6f7fcd 100644
--- a/systems/portal-1/default.nix
+++ b/systems/portal-1/default.nix
@@ -7,8 +7,8 @@
 {
   imports = [
     inputs.disko.nixosModules.disko
-    "${inputs.self}/common/global"
     "${inputs.self}/users/richie"
+    "${inputs.self}/common/global"
     "${inputs.self}/common/optional/tailscale.nix"
     ./disk-config.nix
   ];
diff --git a/systems/rhapsody-in-green/default.nix b/systems/rhapsody-in-green/default.nix
index b5e8957..0e229bb 100644
--- a/systems/rhapsody-in-green/default.nix
+++ b/systems/rhapsody-in-green/default.nix
@@ -8,6 +8,7 @@
     "${inputs.self}/common/optional/steam.nix"
     "${inputs.self}/common/optional/syncthing_base.nix"
     "${inputs.self}/common/optional/systemd-boot.nix"
+    "${inputs.self}/common/optional/tailscale.nix"
     "${inputs.self}/common/optional/yubikey.nix"
     "${inputs.self}/common/optional/zerotier.nix"
     "${inputs.self}/common/optional/zfs"