_:

{
  imports = [ ./enable-service.nix ];

  services.tailscale = {
    # Enables the sysctl forwarding settings subnet routers need;
    # without this, --advertise-routes has no effect.
    useRoutingFeatures = "server";

    # Lets peers reach this node directly over the tailscale UDP port
    # instead of relaying through DERP.
    openFirewall = true;
  };
}