{ pkgs, ... }:

{
  imports = [ ./enable-service.nix ];

  services.tailscale = {
    # Enables the sysctl forwarding settings subnet routers need;
    # without this, --advertise-routes has no effect.
    useRoutingFeatures = "server";

    # Lets peers reach this node directly over the tailscale UDP port
    # instead of relaying through DERP.
    openFirewall = true;
  };

  # Tailscale recommends these ethtool flags on the uplink interface to get
  # full UDP GRO throughput on subnet routers (https://tailscale.com/s/ethtool-config-udp-gro).
  # The interface is derived from the default route so it works regardless of
  # what the NIC is named on a given host.
  systemd.services.tailscale-udp-gro = {
    description = "Enable UDP GRO forwarding on uplink for Tailscale subnet router";
    after = [ "network-online.target" ];
    wants = [ "network-online.target" ];
    wantedBy = [ "multi-user.target" ];
    path = [ pkgs.ethtool pkgs.iproute2 ];
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      ExecStart = pkgs.writeShellScript "tailscale-udp-gro" ''
        NETDEV=$(ip -o route get 8.8.8.8 | cut -f 5 -d " ")
        ethtool -K "$NETDEV" rx-udp-gro-forwarding on rx-gro-list off
      '';
    };
  };
}