Make it so tailscale is not tied to other network config

common/network.nix

@@ -15,33 +15,4 @@ in {
 
   networking.wireless.enable = cfg.wireless;
   networking.networkmanager.enable = cfg.networkManager;
-  
-  services.tailscale.enable = cfg.tailscale.enable;
-
-  systemd.services.tailscale-autoconnect = lib.mkIf cfg.tailscale.enable {
-    description = "Automatic connection to Tailscale";
-
-    # make sure tailscale is running before trying to connect to tailscale
-    after = [ "network-pre.target" "tailscale.service" ];
-    wants = [ "network-pre.target" "tailscale.service" ];
-    wantedBy = [ "multi-user.target" ];
-
-    # set this service as a oneshot job
-    serviceConfig.Type = "oneshot";
-
-    # have the job run this shell script
-    script = with pkgs; ''
-      # wait for tailscaled to settle
-      sleep 2
-
-      # check if we are already authenticated to tailscale
-      status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
-      if [ $status = "Running" ]; then # if so, then do nothing
-        exit 0
-      fi
-
-      # otherwise authenticate with tailscale
-      ${tailscale}/bin/tailscale up -authkey ${cfg.tailscale.key}
-    '';
-  };
 }

common/system.nix

@@ -14,8 +14,7 @@ in {
     git
     vim
     wget
-  ]
-    ++ lib.optionals (config.ashe.network.tailscale.enable) [ tailscale ];
+  ];
 
   services.openssh = {
     enable = true;

common/tailscale.nix

@@ -0,0 +1,45 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let cfg = config.ashe.tailscale;
+in {
+  options.ashe.tailscale = {
+    enable = mkEnableOption "Tailscale";
+    joinKey = mkOption { type = types.str; };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      tailscale
+    ];
+
+    services.tailscale.enable = true;
+
+    systemd.services.tailscale-autoconnect = {
+      description = "Automatic connection to Tailscale";
+
+      # make sure tailscale is running before trying to connect to tailscale
+      after = [ "network-pre.target" "tailscale.service" ];
+      wants = [ "network-pre.target" "tailscale.service" ];
+      wantedBy = [ "multi-user.target" ];
+
+      # set this service as a oneshot job
+      serviceConfig.Type = "oneshot";
+
+      # have the job run this shell script
+      script = with pkgs; ''
+        # wait for tailscaled to settle
+        sleep 2
+
+        # check if we are already authenticated to tailscale
+        status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)"
+        if [ $status = "Running" ]; then # if so, then do nothing
+          exit 0
+        fi
+
+        # otherwise authenticate with tailscale
+        ${tailscale}/bin/tailscale up -authkey ${cfg.joinKey}
+      '';
+    };
+  };
+}

common/variables.nix

@@ -29,10 +29,5 @@ with lib;
     openPorts = mkOption { type = types.listOf types.port; default = [ 22 80 443 ]; };
     wireless = mkEnableOption "wireless";
     networkManager = mkEnableOption "Network Manager";
-
-    tailscale = {
-      enable = mkEnableOption "Enable the tailscale service";
-      key = mkOption { type = types.str; };
-    };
   };
 }

hosts/nyx/configuration.nix

@@ -14,6 +14,7 @@ in {
     ../../common/grub.nix
     ../../common/network.nix
     ../../common/user.nix
+    ../../common/tailscale.nix
   ];
 
   nix.settings.experimental-features = [ "nix-command" "flakes" ];