{ vars, ... }:

{
  imports = [
    ../tailscale/subnet-router.nix
  ];

  # "server", not "both": this build type advertises LAN subnet routes but
  # doesn't use another tailscale exit node itself, so it doesn't need the
  # "client"-side loose reverse-path filtering that "both" would also enable.
  # Deliberately kept explicit here (not just relying on subnet-router.nix's
  # own setting) so the intent is clear at the build-type level.
  services.tailscale.useRoutingFeatures = "server";

  # Advertise the LAN subnet so Tailscale peers can route back to LAN machines.
  # Must also be approved in the Tailscale admin console (Machines → Edit route settings).
  services.tailscale.extraUpFlags = [ "--advertise-routes=${vars.lanCidr}" ];

  # Forwarded subnet-router traffic arrives on tailscale0 already
  # tailscale-authenticated -- the firewall's normal per-port allow-list
  # would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
  networking.firewall.trustedInterfaces = [ "tailscale0" ];

  # SNAT traffic from LAN machines going out through Tailscale so the remote
  # peer sees it sourced from this router's Tailscale IP (100.x.x.x) rather
  # than a raw LAN IP.  Without this, Tailscale drops the forwarded packets
  # because the source is not a recognised Tailscale address.
  networking.nat = {
    enable = true;
    externalInterface = "tailscale0";
  };
}