{
  pkgs,
  config,
  lib,
  ...
}: let
  service = "tailscale";
  cfg = config.homelab.tailscale;
  sec = config.sops.secrets;
in {
  options.homelab.tailscale = {
    enable = lib.mkEnableOption "enables tailscale";
    motd = lib.mkOption {
      type = lib.types.nullOr lib.types.str;
      default = "tailscaled";
    };
  };

  config = lib.mkIf cfg.enable {
    services.${service} = {
      enable = true;
      openFirewall = true;
      useRoutingFeatures = "both";
      authKeyFile = sec."tailscale_authkey".path;
      extraSetFlags = [
        "--advertise-routes=${config.homelab.host_ip}/32,10.10.0.1/32,10.10.0.5/32,10.10.0.10/32" # advertise self
        "--accept-routes=false" # true is equilivant to useRoutingFeatures = "client" (breaks shit)
        "--accept-dns=true" # explicitly allow resolved
      ];
      extraUpFlags = [
      ];
    };

    # network config
    networking.firewall.trustedInterfaces = ["tailscale0"];
    networking.firewall.allowedUDPPorts = [config.services.tailscale.port];

    # declare authkey secrets
    sops.secrets = {
      "tailscale_authkey" = {
        owner = "root";
      };
    };
  };
}