From c5a231baffe6c95565c1a96f6aa4414bd60ec845 Mon Sep 17 00:00:00 2001
From: Erik Simon <mail@erik-s.dev>
Date: Wed, 29 Jul 2026 21:43:16 +0200
Subject: [PATCH] tailscale: pin vendorHash for 1.98.9 (nixpkgs bump missed it)

TEMPORARY: nixpkgs bumped tailscale 1.98.8->1.98.9 without updating
vendorHash (NixOS/nixpkgs#545860, fixed on release-26.05 but not yet
promoted to the nixos-26.05 channel branch this flake tracks). Remove once
`nix flake lock --update-input nixpkgs` picks up a fixed rev.
---
 services/vpn/tailscale.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/services/vpn/tailscale.nix b/services/vpn/tailscale.nix
index 86e93d7..8c874af 100644
--- a/services/vpn/tailscale.nix
+++ b/services/vpn/tailscale.nix
@@ -5,6 +5,19 @@
 # to declare `sops.secrets.tailscale_authkey` (see each host's secrets.nix).
 # Not for the VM (no sops).
 {
+  # TEMPORARY: nixpkgs bumped tailscale 1.98.8->1.98.9 without updating
+  # vendorHash (NixOS/nixpkgs#545860, fixed on the `release-26.05` branch
+  # 2026-07-26 but not yet promoted to the `nixos-26.05` channel branch this
+  # flake tracks). Remove this override once `nix flake lock --update-input
+  # nixpkgs` picks up a nixos-26.05 rev at/after that fix.
+  nixpkgs.overlays = [
+    (final: prev: {
+      tailscale = prev.tailscale.overrideAttrs (old: {
+        vendorHash = "sha256-Sd2iLJ7eDfDYdIRuW4xuiKgzhQWJWGAnz97FJWrVRlE=";
+      });
+    })
+  ];
+
   services.tailscale = {
     enable = true;
     openFirewall = true;                       # UDP 41641 for direct connections