{ ... }:

{
  imports = [
    ../tailscale/exit-node.nix
  ];

  # "server", not "both": this build type only ever advertises itself as an
  # exit node (see ../tailscale/exit-node.nix) -- it doesn't advertise LAN
  # subnet routes, so it doesn't need the "client"-side loose reverse-path
  # filtering that "both" would also turn on. Deliberately left unbundled
  # from LAN-subnet-route advertisement so this build type stays valid on
  # every platform, including linode (a remote VPS with no network path to
  # the home LAN at all).
  services.tailscale.useRoutingFeatures = "server";

  # Forwarded exit-node traffic arrives on tailscale0 already
  # tailscale-authenticated -- the firewall's normal per-port allow-list
  # would otherwise drop it. Standard NixOS/Tailscale exit-node guidance.
  networking.firewall.trustedInterfaces = [ "tailscale0" ];
}