{ vars, ... }:

{
  networking = {
    hostName = "tailscale-router";
    useDHCP = false;
    interfaces.${vars.lxcLanInterface}.ipv4.addresses = [{
      address = vars.tailscaleRouterIp;
      prefixLength = vars.lanPrefixLength;
    }];
    defaultGateway = { address = vars.lanGateway; interface = vars.lxcLanInterface; };
    nameservers = [ vars.domainControllerIp ];
  };

  services.beszel.agent.environment = {
    KEY = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFPR9kwtC4TAeTRu46A7+opZsYpxqkRJ+x/ZyB2GWCeG";
  };

  # No networking.hostId: only ZFS-touching hosts (server, docker) need one
  # for pool-import safety, and this host does neither.

  system.stateVersion = "26.05";
}