nixos: tailscale auto-connect via agenix auth key

2026-02-13 04:35:47 -08:00
parent fa81dac17f
commit 8dde61a230
4 changed files with 116 additions and 1 deletions
--- a/nixos/secrets/secrets.nix
+++ b/nixos/secrets/secrets.nix
@@ -25,4 +25,8 @@ in
  "org-api-ssh-key.age".publicKeys = keys.hostKeys ++ keys.kanivanKeys ++ keys.railbird-sf;
  "google-assistant-integration-service-key.age".publicKeys = keys.hostKeys ++ keys.kanivanKeys;
  "zwave-js.json.age".publicKeys = keys.hostKeys ++ keys.kanivanKeys;
+
+  # Optional Tailscale pre-auth key for unattended enrollment.
+  # This is safe to commit encrypted; default plaintext is "DISABLED".
+  "tailscale-authkey.age".publicKeys = keys.kanivanKeys;
 }