{ config, lib, pkgs, ... }:

with lib;

let
  cfg = config.services.tailscale-node;
in {
  options.services.tailscale-node = {
    enable = mkEnableOption "Tailscale mesh node";
    authKeyFile = mkOption {
      type = types.nullOr types.str;
      default = null;
      description = "Path to file containing Tailscale pre-auth key (for unattended setup).";
    };
  };

  config = mkIf cfg.enable {
    services.tailscale = {
      enable = true;
      interfaceName = "tailscale0";
      authKeyFile = cfg.authKeyFile;
      extraUpFlags = "--accept-routes --accept-dns=false";
    };

    # Persist Tailscale state across reboots
    systemd.services.tailscale = {
      after = [ "network-online.target" ];
      wants = [ "network-online.target" ];
      serviceConfig.SupplementaryGroups = [ "nginx" ];
    };

    networking.firewall.trustedInterfaces = [ "tailscale0" ];
  };
}