feat(nixos:tailscale): add auto-connect service

nixos/modules/base/default.nix

@@ -7,5 +7,6 @@
     ./security
     ./shell
     ./locale.nix
+    ./secrets.nix
   ];
 }

nixos/modules/base/networking/tailscale.nix

@@ -3,9 +3,7 @@
 let
   cfg = config.ooknet.host.networking.tailscale;
   inherit (config.services) tailscale;
-  inherit (lib.lists) optionals;
-  inherit (lib.strings) concatStringsSep;
-  inherit (lib) mkIf mkDefault;
+  inherit (lib) mkIf mkDefault mkBefore;
 in
 
 {
@@ -15,10 +13,7 @@ in
       enable = true;
       useRoutingFeatures = mkDefault "both";
       # permitCertUid = "root";
-      extraUpFlags = 
-        [ "--ssh" "--operator=$USER" ]
-        ++ optionals cfg.server [ "--advertise-exit-node" ]
-        ++ optionals (cfg.tags != []) ["--advertise-tags" (concatStringsSep "," cfg.tags)]; 
+      extraUpFlags = cfg.flags.final;
     };
 
     networking.firewall = {
@@ -30,5 +25,30 @@ in
     systemd.network.wait-online.ignoredInterfaces = ["${tailscale.interfaceName}"];
 
     environment.systemPackages = [ pkgs.tailscale ];
+
+    # disable tailscale logging
+    systemd.services.tailscaled.serviceConfig.Environment = mkBefore ["TS_NO_LOGS_NO_SUPPORT"];
+
+    systemd.services.tailscale-autoconnect = mkIf cfg.autoconnect {
+      description = "Automatic connection to Tailscale";
+
+      after = [ "network-pre.target" "tailscale.service" ];
+      wants = [ "network-pre.target" "tailscale.service" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig.Type = "oneshot";
+
+      script = /* bash */ ''
+        sleep 2
+
+        status="$(${tailscale.package}/bin/tailscale status -json | ${pkgs.jq}/bin/jq -r .BackendState)"
+
+        if [ $status = "Running" ]; then
+          exit 0
+        fi
+
+        ${tailscale.package}/bin/tailscale up ${toString tailscale.extraUpFlags}
+      '';
+    };
   };
 }