{ config, ... }:

# Tailscale node joined to the self-hosted headscale control server,
# auto-registering on boot from a sops pre-auth key — importing hosts must
# declare `sops.secrets.tailscale_authkey` (see each host's secrets.nix).
# Not used by the VM target (no sops there).
{
  services.tailscale = {
    enable = true;
    openFirewall = true;                       # UDP 41641 for direct connections
    authKeyFile = config.sops.secrets.tailscale_authkey.path;
    extraUpFlags = [ "--login-server=https://vpn.mgaction.town" ];
  };
  # Reach the host's services over the tailnet without opening LAN ports.
  networking.firewall.trustedInterfaces = [ "tailscale0" ];

  # The upstream unit is a one-shot with no Restart, so a login attempted
  # before the control server is up fails permanently until restarted by
  # hand — the norm on first boot, since neptun hosts headscale itself and
  # other hosts race it. 30s spacing keeps retries clear of systemd's default
  # start limit (5 within 10s).
  systemd.services.tailscaled-autoconnect.serviceConfig = {
    Restart = "on-failure";
    RestartSec = 30;
  };
}