{
  config,
  lib,
  ...
}:
let
  lan = builtins.head config.networking.nat.internalInterfaces;

  networks = [
    "10.0.0.0/16"
    "fd12:d04f:65d::/56"
  ];
in
{
  networking.firewall.extraForwardRules = ''
    iifname "tailscale0" oifname "${lan}" accept
    iifname "${lan}" oifname "tailscale0" accept
  '';

  services.tailscale.extraSetFlags = [
    "--advertise-routes"
    (lib.join "," networks)
  ];
}