{ config, lib, ... }:
{
  # https://login.tailscale.com/admin/machines

  imports = [ ./shared.nix ];

  config = lib.mkIf (!config.virtualisation.isVmVariant) {

    # https://tailscale.com/kb/1085/auth-keys
    services.tailscale.authKeyFile = config.sops.secrets.tailscale-authkey-outer.path; # also enables autoconnect
    sops.secrets.tailscale-authkey-outer.sopsFile = ../../secrets/tailscale-outer.yaml;

  };
}