From c9394549836c8d4458611572af4c4d9d83272a5c Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Mon, 20 Jul 2026 12:24:18 +1000 Subject: [PATCH] Fix tailscale exit-node module: enable routing, compose on enable-service exit-node.nix advertised --advertise-exit-node/--advertise-routes but never enabled IP forwarding, so it wouldn't actually route traffic. services.tailscale.useRoutingFeatures = "server" is the built-in way to get the sysctls right without duplicating modules/networking/enable-ip-forwarding.nix. Also opens the firewall for direct (non-DERP-relayed) peer connections, and now imports enable-service.nix instead of duplicating `enable = true`, so "plain tailscale" and "tailscale exit node" are two composable modules. Co-Authored-By: Claude Sonnet 5 --- modules/tailscale/exit-node.nix | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/modules/tailscale/exit-node.nix b/modules/tailscale/exit-node.nix index 73d9f8a..a965fe5 100644 --- a/modules/tailscale/exit-node.nix +++ b/modules/tailscale/exit-node.nix @@ -1,8 +1,16 @@ { vars, ... }: { + imports = [ ./enable-service.nix ]; + services.tailscale = { - enable = true; + # Enables the sysctl forwarding settings exit nodes/subnet routers need; + # without this, --advertise-exit-node has no effect. + useRoutingFeatures = "server"; + + # Lets peers reach this node directly over the tailscale UDP port + # instead of relaying through DERP. + openFirewall = true; extraUpFlags = [ "--advertise-exit-node"