{ ... }:

{
  imports = [
    ../tailscale/subnet-router.nix
  ];

  # "server", not "both": this build type advertises LAN subnet routes but
  # doesn't use another tailscale exit node itself, so it doesn't need the
  # "client"-side loose reverse-path filtering that "both" would also enable.
  # Deliberately kept explicit here (not just relying on subnet-router.nix's
  # own setting) so the intent is clear at the build-type level.
  services.tailscale.useRoutingFeatures = "server";

  # Forwarded subnet-router traffic arrives on tailscale0 already
  # tailscale-authenticated -- the firewall's normal per-port allow-list
  # would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
  networking.firewall.trustedInterfaces = [ "tailscale0" ];
}