Add authkey to tailscale module

modules/networking/tailscale.nix

@@ -1,6 +1,9 @@
-{ config, lib, pkgs, ... }:
+{ config, inputs, lib, pkgs, ... }:
 
-let cfg = config.modules.networking.tailscale;
+let
+  cfg = config.modules.networking.tailscale;
+  headscale = "https://headscale.vimium.net";
+  hostname = config.networking.hostName;
 in {
   options.modules.networking.tailscale = {
     enable = lib.mkOption {
@@ -14,8 +17,24 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-    services.tailscale.enable = true;
+    age.secrets."passwords/services/tailscale/${hostname}-authkey" = {
+      file = "${inputs.secrets}/passwords/services/tailscale/${hostname}-authkey.age";
+    };
+
+    environment.systemPackages = [ pkgs.tailscale ];
+
+    services.tailscale = {
+      enable = true;
+      authKeyFile = config.age.secrets."passwords/services/tailscale/${hostname}-authkey".path;
+
+      extraUpFlags = [
+        "--login-server"
+        headscale
+      ];
+    };
+
     services.openssh.openFirewall = !cfg.restrictSSH;
+
     networking.firewall = {
       checkReversePath = "loose";
       trustedInterfaces = [ "tailscale0" ];