containers/fluorite/configuration.nix

@@ -1,30 +1,16 @@
 { ... }: {
   system.stateVersion = "25.11";
   systemd.tmpfiles.rules = [
-    "d /persist/slskd/downloads 755 slskd slskd"
+    "d /persist/slskd/Downloads 755 slskd slskd"
   ];
   fileSystems."/var/lib/slskd" = {
     device = "/persist/slskd";
     fsType = "none";
     options = [ "bind" ];
   };
-  fileSystems."/var/lib/tailscale" = {
-    device = "/persist/tailscale";
-    fsType = "none";
-    options = [ "bind" ];
-  };
   networking.firewall.allowedTCPPorts = [ 5030 50300 ];
   networking.firewall.allowedUDPPorts = [ 5030 50300 ];
 
-  services.tailscale = {
-    enable = true;
-    authKeyFile = "/binds/tailscale_auth";
-    openFirewall = true;
-    interfaceName = "userspace-networking";
-    extraDaemonFlags = [ "--socks5-server=localhost:1055" ];
-    extraUpFlags = [ "--exit-node=dandelion" ];
-  };
-
   services.slskd = {
     enable = true;
     domain = null;

containers/fluorite/flake.nix

@@ -20,7 +20,7 @@
       ./configuration.nix
       {
         networking.useHostResolvConf = false;
-        networking.nameservers = [ 8.8.8.8 ];
+        networking.nameservers = [ host ];
       }
     ];
   in {
@@ -97,11 +97,6 @@
           mountPoint = "/binds/slskd_env";
           isReadOnly = true;
         };
-        bindMounts."tailscale_auth" = {
-          hostPath = config.age.secrets.tailscale_auth.path;
-          mountPoint = "/binds/tailscale_auth";
-          isReadOnly = true;
-        };
         # flake = "path:" + ./.;
       };
     };

hosts/dandelion/default.nix

@@ -32,6 +32,7 @@
     inputs.c-citrine.nixosModule
     inputs.c-diamond.nixosModule
     inputs.c-emerald.nixosModule
+    inputs.c-fluorite.nixosModule
 
     ./filesystem.nix
     ./kernel.nix

modules/system/tailscale.nix

@@ -4,17 +4,6 @@
   networking.firewall.trustedInterfaces = [ "tailscale0" ];
   networking.firewall.allowedUDPPorts = lib.mkIf (config.me.environment == "headless") [ 123 ];
 
-  networking.nat = {
-    enable = true;
-    internalInterfaces = [ "tailscaled0" ];
-    forwardPorts = [
-      {
-        sourcePort = 50300;
-        proto = "tcp";
-        destination = "100.67.2.101:50300";
-      }
-    ];
-  };
   services.tailscale = {
     enable = true;
     authKeyFile = config.age.secrets.tailscale_auth.path;