{ pkgs, ... }:

{

  services.tailscale = {
    enable = true;
    openFirewall = true;
    extraUpFlags = [ "--ssh" ];
  };

  environment.systemPackages = [ pkgs.tail-tray ]; # or pkgs.trayscale

  systemd.user.services.tail-tray = {
    description = "Tailscale tray (Plasma)";
    wantedBy = [ "graphical-session.target" ];
    after = [ "graphical-session.target" ];
    serviceConfig = {
      ExecStart = "${pkgs.tail-tray}/bin/tail-tray";
      Restart = "on-failure";
    };
  };