init

system/network/default.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ./tailscale.nix
+  ];
+}

system/network/tailscale.nix

@@ -0,0 +1,11 @@
+{ config, ... }:
+{
+  networking.firewall = {
+    trustedInterfaces = [ config.services.tailscale.interfaceName ];
+  };
+
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;
+  };
+}