{
  flake.modules.nixos.tailscale = {
    services.tailscale.enable = true;
    # Keep existing SSH exposure until tailnet enrollment and access are verified.
    networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 22 ];
  };
}