@@ -253,7 +253,6 @@ 6885 # DHT
         6922
       ];
       trustedInterfaces = [
-        "tailscale0"
         "podman0"
       ];
     };
@@ -271,16 +270,6 @@ DNSSEC = true;
     };
   };
   systemd.network.wait-online.enable = lib.mkForce true;
-
-  services.tailscale = {
-    enable = true;
-    openFirewall = true;
-    extraUpFlags = [ "--accept-routes" ];
-    extraSetFlags = [
-      "--advertise-exit-node"
-    ];
-    useRoutingFeatures = "both";
-  };
 
   services.mycal = {
     enable = true;

@@ -86,9 +86,6 @@ ];
       allowedUDPPorts = [
         443
       ];
-      trustedInterfaces = [
-        "tailscale0"
-      ];
     };
   };
 
@@ -105,15 +102,6 @@ dates = [ "02:30" ];
     };
   };
 
-  services.tailscale = {
-    enable = true;
-    openFirewall = true;
-    extraUpFlags = [ "--accept-routes" ];
-    extraSetFlags = [
-      "--advertise-exit-node"
-    ];
-    useRoutingFeatures = "both";
-  };
   users.defaultUserShell = config.programs.fish.package;
   programs.fish = {
     enable = true;

@@ -2,6 +2,15 @@ { ... }:
 {
   imports = [
     ../settings/configuration/nix-linux.nix
+
+    ../settings/services/tailscale.nix
     ../settings/services/caddy.nix
   ];
+
+  services.tailscale = {
+    useRoutingFeatures = "both";
+    extraSetFlags = [
+      "--advertise-exit-node"
+    ];
+  };
 }

@@ -0,0 +1,12 @@
+{ ... }:
+{
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;
+    extraSetFlags = [
+      "--accept-routes"
+    ];
+  };
+
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
+}