WIP: router: tailscale

modules/router/tailscale.nix

@@ -0,0 +1,44 @@
+{ config, lib, pkgs, ... }:
+let
+  vars = import ./vars.nix config;
+  ifs = vars.ifs;
+  ts0 = ifs.ts0;
+
+  # Subnets advertised to the tailnet (still need to be approved in the admin console)
+  advertisedRoutes = [
+    "${vars.p4}.0.0/16"          # all LAN v4 subnets
+    "${vars.ulaPrefix}::/48"     # all LAN ULA subnets
+  ];
+in
+{
+  # One-time setup after deploying: `sudo tailscale up`
+  # (state is persisted in /var/lib/tailscale)
+  services.tailscale = {
+    enable = true;
+    port = ts0.listenPort;
+    interfaceName = ts0.name;
+    # Enables ip forwarding (already enabled globally by networkd anyway).
+    # Not using "both", since that sets rp_filter to loose on all interfaces.
+    useRoutingFeatures = "server";
+    # Firewall is managed manually in firewall.nix (networking.firewall is disabled)
+    openFirewall = false;
+    # Applied with `tailscale set` on every start, so these stay declarative
+    extraSetFlags = [
+      # Don't let tailscale touch nftables/iptables, all rules live in firewall.nix
+      "--netfilter-mode=off"
+      # Don't SNAT tailnet -> LAN traffic, LAN hosts route back via the router anyway
+      # (preserves real source addrs for logging/ACLs on LAN hosts)
+      "--snat-subnet-routes=false"
+      # The router is its own DNS server, don't let tailscale mess with resolv.conf
+      "--accept-dns=false"
+      "--advertise-routes=${lib.strings.concatStringsSep "," advertisedRoutes}"
+      "--advertise-exit-node"
+    ];
+  };
+
+  # networkd removes "foreign" ip rules when it (re)starts, which would wipe tailscale's
+  # policy routing rules (table 52). This is extra important since networkd is
+  # restarted every minute (see ifconfig.nix).
+  # The nixpkgs tailscale module already marks tailscale0 as unmanaged in networkd.
+  systemd.network.config.networkConfig.ManageForeignRoutingPolicyRules = false;
+}