feat(tailscale): enable mesh networking across NixOS hosts

- enable Tailscale on Bob, Brain, Jeeves, and Rhapsody
- configure the Jeeves binary cache through Tailscale MagicDNS
- trust the existing workshop cache signing key

common/optional/tailscale.nix

@@ -6,6 +6,12 @@
 {
   networking.firewall.trustedInterfaces = [ "tailscale0" ];
 
+  nix.settings = {
+    trusted-substituters = [ "http://jeeves:5000" ];
+    substituters = [ "http://jeeves:5000/?priority=1&want-mass-query=true" ];
+    trusted-public-keys = [ "cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA=" ];
+  };
+
   services.tailscale = {
     enable = true;
     openFirewall = true;

systems/bob/default.nix

@@ -12,6 +12,7 @@
     "${inputs.self}/common/optional/steam.nix"
     "${inputs.self}/common/optional/syncthing_base.nix"
     "${inputs.self}/common/optional/systemd-boot.nix"
+    "${inputs.self}/common/optional/tailscale.nix"
     "${inputs.self}/common/optional/update.nix"
     "${inputs.self}/common/optional/yubikey.nix"
     "${inputs.self}/common/optional/zerotier.nix"

systems/brain/default.nix

@@ -7,6 +7,7 @@
     "${inputs.self}/common/optional/ssh_decrypt.nix"
     "${inputs.self}/common/optional/syncthing_base.nix"
     "${inputs.self}/common/optional/systemd-boot.nix"
+    "${inputs.self}/common/optional/tailscale.nix"
     "${inputs.self}/common/optional/update.nix"
     "${inputs.self}/common/optional/zerotier.nix"
     "${inputs.self}/common/optional/zfs"

systems/jeeves/default.nix

@@ -13,6 +13,7 @@ in
     "${inputs.self}/common/optional/monitoring-agent.nix"
     "${inputs.self}/common/optional/ssh_decrypt.nix"
     "${inputs.self}/common/optional/syncthing_base.nix"
+    "${inputs.self}/common/optional/tailscale.nix"
     "${inputs.self}/common/optional/update.nix"
     "${inputs.self}/common/optional/zerotier.nix"
     "${inputs.self}/common/optional/zfs"

systems/portal-1/default.nix

@@ -7,8 +7,8 @@
 {
   imports = [
     inputs.disko.nixosModules.disko
-    "${inputs.self}/common/global"
     "${inputs.self}/users/richie"
+    "${inputs.self}/common/global"
     "${inputs.self}/common/optional/tailscale.nix"
     ./disk-config.nix
   ];

systems/rhapsody-in-green/default.nix

@@ -8,6 +8,7 @@
     "${inputs.self}/common/optional/steam.nix"
     "${inputs.self}/common/optional/syncthing_base.nix"
     "${inputs.self}/common/optional/systemd-boot.nix"
+    "${inputs.self}/common/optional/tailscale.nix"
     "${inputs.self}/common/optional/yubikey.nix"
     "${inputs.self}/common/optional/zerotier.nix"
     "${inputs.self}/common/optional/zfs"