feat(nixos): Auto-re-auth tailscale on server reboot

hosts/server/default.nix

@@ -24,6 +24,7 @@
     ./content.nix
     ./nas.nix
     ./containers.nix
+    ./tailscale.nix
   ];
 
   powerManagement.cpuFreqGovernor = "performance";
@@ -36,8 +37,6 @@
     };
   };
   services = {
-    tailscale.enable = true;
-    tailscale.authKeyFile = config.age.secrets.tailscale.path;
     fail2ban.enable = true;
     openssh = {
       enable = true;

hosts/server/tailscale.nix

@@ -0,0 +1,35 @@
+{ config, pkgs, ... }: {
+  services = {
+    tailscale = {
+      enable = true;
+      authKeyFile = config.age.secrets.tailscale.path;
+    };
+  };
+
+  systemd.services.tailscale-autoconnect = {
+    description = "Automatic connection to Tailscale";
+
+    # make sure tailscale is running before trying to connect to tailscale
+    after = [ "network-pre.target" "tailscale.service" ];
+    wants = [ "network-pre.target" "tailscale.service" ];
+    wantedBy = [ "multi-user.target" ];
+
+    # set this service as a oneshot job
+    serviceConfig.Type = "oneshot";
+
+    # have the job run this shell script
+    script = ''
+      # wait for tailscaled to settle
+      sleep 2
+
+      # check if we are already authenticated to tailscale
+      status="$(${pkgs.tailscale}/bin/tailscale status -json | ${pkgs.jq}/bin/jq -r .BackendState)"
+      if [ $status = "Running" ]; then # if so, then do nothing
+        exit 0
+      fi
+
+      # otherwise authenticate with tailscale
+      ${pkgs.tailscale}/bin/tailscale up --auth-key "file:${config.age.secrets.tailscale.path}"
+    '';
+  };
+}