Tailscale

 services.tailscale = {
    enable = true;
    openFirewall = true;
    authKeyFile = path-to-key;
    extraUpFlags = [
      "--login-server=https://your-instance" # if you use a non-default tailscale coordinator
      "--accept-dns=false" # if its' a server you prolly dont need magicdns
    ];
  };