{ vars, ... }:

{
  imports = [ ./enable-service.nix ];

  services.tailscale = {
    # Enables the sysctl forwarding settings exit nodes/subnet routers need;
    # without this, --advertise-exit-node has no effect.
    useRoutingFeatures = "server";

    # Lets peers reach this node directly over the tailscale UDP port
    # instead of relaying through DERP.
    openFirewall = true;

    extraUpFlags = [
      "--advertise-exit-node"
      "--advertise-routes=${vars.lanCidr}"
    ];
  };
}