Problem: extraUpFlags in services.tailscale blocks boot if network
is not ready or Headscale is unreachable.
Solution:
- services.tailscale.enable = true (installs tailscale)
- Separate kawa-mesh-connect systemd service:
- Waits for network-online.target
- Waits for tailscaled.service
- Connects to mesh after boot
Commands to verify:
systemctl status tailscaled
systemctl status kawa-mesh-connect
tailscale status
- Fix hostname: static value instead of /sys read (pure mode)
- Fix NATS: use settings.http_port instead of httpPort
- Add kawa-base.nix with corrected NATS options
- Update flake.nix to include all modules
- Enable SSH with PermitRootLogin for debugging
