{
  config,
  lib,
  pkgs,
  ...
}: {
  services.tailscale = {
    enable = true;
    openFirewall = true;
  };

  # Implicitly trust packets routed over Tailscale
  networking.firewall.trustedInterfaces = [config.services.tailscale.interfaceName];
}