init

system/network/avahi.nix

@@ -0,0 +1,12 @@
+{
+  # network discovery, mDNS
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    publish = {
+      enable = true;
+      domain = true;
+      userServices = true;
+    };
+  };
+}

system/network/networkd.nix

@@ -0,0 +1,15 @@
+{
+  networking.useNetworkd = true;
+  systemd.network = {
+    enable = true;
+    networks."10-lan" = {
+      matchConfig.Name = "lan";
+      networkConfig.DHCP = "ipv4";
+    };
+  };
+  services.resolved = {
+    enable = true;
+    dnssec = "true";
+    domains = ["~."];
+  };
+}

system/network/tailscale.nix

@@ -0,0 +1,8 @@
+{config, ...}: {
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;
+    useRoutingFeatures = "client";
+    authKeyFile = config.sops.secrets.tailscale-auth.path;
+  };
+}