lfrc symlink

modules/system/tailscale.nix

@@ -1,10 +1,12 @@
-{ pkgs, config, lib, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
   cfg = config.modules.system.tailscale;
   authkey_file = config.sops.secrets."tailscale_authkey".path;
-in
-{
+in {
   options.modules.system.tailscale = {
     enable = lib.mkEnableOption "enables tailscale";
   };
@@ -15,14 +17,18 @@ in
       useRoutingFeatures = "both";
       authKeyFile = authkey_file;
       extraUpFlags = [
-        "--accept-routes=false"   # true is equilivant to useRoutingFeatures = "client" (breaks shit)
-        "--accept-dns=true"       # explicitly allow resolved
+        "--accept-routes=false" # true is equilivant to useRoutingFeatures = "client" (breaks shit)
+        "--accept-dns=true" # explicitly allow resolved
       ];
     };
 
+    # network config
+    networking.firewall.trustedInterfaces = ["tailscale0"];
+    networking.firewall.allowedUDPPorts = [config.services.tailscale.port];
+
     # declare authkey secrets
     sops.secrets = {
-      "tailscale_authkey" = { 
+      "tailscale_authkey" = {
         owner = "root";
       };
     };