fix(tailscale): open Tailscale's WireGuard port in the firewall

services.tailscale.openFirewall defaults to false while the NixOS firewall is enabled, so argon, krypton and neon dropped unsolicited inbound 41641/udp. Direct connections then only succeed if the other peer accepts inbound; between two of these hosts (or a host and a phone) traffic can fall back to a DERP relay. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merge pull request 'feature(git): enable git lfs for my user' (#108 ) from feature/add_tea into main
2026-10-20 12:48:41 +02:00 · 2026-10-18 14:43:17 +02:00 · 2026-10-18 14:42:07 +02:00
3 changed files with 7 additions and 2 deletions
@@ -24,6 +24,7 @@ in

  programs.git = {
    enable = true;
+    lfs.enable = true;
    settings = {
      push.autoSetupRemote = true;
      user = {
@@ -4,6 +4,10 @@
    tuned.enable = true;
    upower.enable = true;
    fwupd.enable = true;
-    tailscale.enable = true;
+    tailscale = {
+      enable = true;
+      # inbound 41641/udp so peers can connect directly instead of via DERP
+      openFirewall = true;
+    };
  };
 }