updates

modules/capabilities/tailscale.nix

@@ -0,0 +1,7 @@
+{
+  flake.modules.nixos.tailscale = {
+    services.tailscale.enable = true;
+    # Keep existing SSH exposure until tailnet enrollment and access are verified.
+    networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 22 ];
+  };
+}