From d421a89bd9a1a73d899afe07a99a1439e7c0dcf8 Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Wed, 21 Oct 2026 23:21:23 +0800
Subject: [PATCH] fix(tailscale): drop a duplicate CLI install and a stale
 comment

Assisted-by: DeepSeek Harness 0.2.1-rc.2 (deepseek-flash)
---
 hosts/12kingdoms-youko/vpn.nix                 | 6 +++---
 modules/nixos/desktop/networking/tailscale.nix | 8 +++-----
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/hosts/12kingdoms-youko/vpn.nix b/hosts/12kingdoms-youko/vpn.nix
index 747f5519..407a23a2 100644
--- a/hosts/12kingdoms-youko/vpn.nix
+++ b/hosts/12kingdoms-youko/vpn.nix
@@ -1,5 +1,4 @@
 {
-  pkgs,
   myvars,
   ...
 }:
@@ -7,13 +6,14 @@ let
   inherit (myvars.networking) hostsAddr k8sVip;
 in
 {
-  environment.systemPackages = [ pkgs.tailscale ];
+  # `services.tailscale` already puts the CLI in `environment.systemPackages`.
 
   services.tailscale = {
     enable = true;
     port = 41641;
     interfaceName = "tailscale0";
-    # allow the Tailscale UDP port through the firewall
+    # No-op here: the shared firewall opens 41641 in `extraInputRules` and
+    # forces `allowedUDPPorts` empty.
     openFirewall = true;
 
     useRoutingFeatures = "server";
diff --git a/modules/nixos/desktop/networking/tailscale.nix b/modules/nixos/desktop/networking/tailscale.nix
index 19b2dfc9..80d178db 100644
--- a/modules/nixos/desktop/networking/tailscale.nix
+++ b/modules/nixos/desktop/networking/tailscale.nix
@@ -1,6 +1,4 @@
 {
-  lib,
-  pkgs,
   ...
 }:
 # =============================================================
@@ -28,15 +26,15 @@
 #
 # =============================================================
 {
-  # make the tailscale command usable to users
-  environment.systemPackages = [ pkgs.tailscale ];
+  # `services.tailscale` already puts the CLI in `environment.systemPackages`.
 
   # enable the tailscale service
   services.tailscale = {
     enable = true;
     port = 41641;
     interfaceName = "tailscale0";
-    # allow the Tailscale UDP port through the firewall
+    # No-op here: the shared firewall opens 41641 in `extraInputRules` and
+    # forces `allowedUDPPorts` empty.
     openFirewall = true;
 
     useRoutingFeatures = "client";