{
  config,
  lib,
  ...
}: let
  cfg = config.roles.tailscale;
in {
  options.roles.tailscale = {
    enable = lib.mkEnableOption "Tailscale";
    authKeyFile = lib.mkOption {
      type = lib.types.nullOr lib.types.path;
      default = null;
    };
    interfaceName = lib.mkOption {
      type = lib.types.str;
      default = "tailscale0";
    };
    enableSSH = lib.mkOption {
      type = lib.types.bool;
      default = false;
    };
  };

  config = lib.mkIf cfg.enable {
    services.tailscale = {
      enable = true;
      authKeyFile = lib.mkIf (cfg.authKeyFile != null) cfg.authKeyFile;
      extraUpFlags = lib.mkIf (cfg.enableSSH) ["--ssh"]; # TODO: Make modular for multiple possible flags.
      interfaceName = cfg.interfaceName;
      openFirewall = false;
      useRoutingFeatures = "none";
    };
  };
}