{ vars, ... }:

{
  imports = [
    ../tailscale/subnet-router.nix
    ../tailscale/ts-dns-forwarder.nix
    ../beszel/enable-agent.nix
  ];

  # "server", not "both": this build type advertises LAN subnet routes but
  # doesn't use another tailscale exit node itself, so it doesn't need the
  # "client"-side loose reverse-path filtering that "both" would also enable.
  # Deliberately kept explicit here (not just relying on subnet-router.nix's
  # own setting) so the intent is clear at the build-type level.
  services.tailscale.useRoutingFeatures = "server";

  # Advertise the LAN subnet so Tailscale peers can route back to LAN machines.
  # Must also be approved in the Tailscale admin console (Machines → Edit route settings).
  services.tailscale.extraUpFlags = [ "--advertise-routes=${vars.lanCidr}" ];

  networking.firewall = {
    # Forwarded subnet-router traffic arrives on tailscale0 already
    # tailscale-authenticated -- the firewall's normal per-port allow-list
    # would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
    trustedInterfaces = [ "tailscale0" ];

    # SNAT LAN traffic going into Tailscale so the remote peer sees it as
    # coming from this router's Tailscale IP rather than a raw LAN IP.
    # Without this, Tailscale drops forwarded packets whose source is not a
    # recognised Tailscale address.
    #
    # We target POSTROUTING directly (always-existing built-in chain) rather
    # than nixos-nat-post: extraCommands runs after the old nixos-nat-post is
    # deleted but before the new one is created, so -A nixos-nat-post silently
    # fails.  The -C check makes the rule idempotent across firewall reloads.
    extraCommands = ''
      iptables -t nat -C POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE 2>/dev/null || \
        iptables -t nat -A POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE
    '';
    extraStopCommands = ''
      iptables -t nat -D POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE 2>/dev/null || true
    '';
  };
}