{
  config,
  inputs,
  ...
}:
{
  networking.firewall.trustedInterfaces = [ "tailscale0" ];

  services.tailscale = {
    enable = true;
    openFirewall = true;
    authKeyFile = config.sops.secrets.tailscale_auth_key.path;

    # OAuth client secrets create ephemeral nodes by default. NixOS machines
    # are persistent and should enroll without interactive device approval.
    authKeyParameters = {
      ephemeral = false;
      preauthorized = true;
    };

    extraUpFlags = [ "--advertise-tags=tag:nixos" ];
  };

  sops = {
    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];

    secrets.tailscale_auth_key = {
      sopsFile = "${inputs.self}/users/secrets.yaml";
      owner = "root";
      mode = "0400";
    };
  };
}