initial commit. after fucking it up once

networking/tailscale.mod.nix

@@ -0,0 +1,49 @@
+{
+  # i am shameless, i know -e
+  aspartame.modules = [
+    {
+      services.headscale = {
+        enable = true;
+        port = 6562;
+        settings = {
+          server_url = "https://vpn.collective-conciousness.monster";
+          dns.magic_dns = false;
+
+          log.level = "warn";
+          logtail.enables = false;
+          metrics_listen_addr = "127.0.0.1:6563";
+
+          ip_prefixes = [
+            "100.81.0.0/10"
+            "fd7a:115c:a1e0::/48"
+          ];
+
+          derp.server = {
+            enable = true;
+            region_id = 999;
+            stun_listen_addr = "0.0.0.0:6561";
+          };
+        };
+      };
+      networking.firewall.allowedUDPPorts = [ 6561 ];
+    }
+  ];
+
+  universal.modules = [
+    {
+      services.tailscale = {
+        enable = true;
+        openFirewall = true;
+        useRoutingFeatures = "both";
+      };
+    }
+  ];
+
+  sucrose.modules = [
+    {
+      services.tailscale.extraSetFlags = [
+        "--advertise-exit-node"
+      ];
+    }
+  ];
+}