{
  config,
  pkgs,
  lib,
  ...
}:
let
  inherit (lib) mkIf;

  cfg = config.aa.services.tailscale;
in
{
  options.aa.services.tailscale = with lib; {
    enable = mkEnableOption "tailscale";
    configureClientRouting = mkOption {
      type = types.bool;
      default = false;
      description = mdDoc ''
        Configures tailscale as a client.

        See `options.services.tailscale.useRoutingFeatures` for more information.
      '';
    };
    configureServerRouting = mkOption {
      type = types.bool;
      default = false;
      description = mdDoc ''
        Configures tailscale as a server.

        See `options.services.tailscale.useRoutingFeatures` for more information.
      '';
    };
  };

  config = mkIf cfg.enable {
    environment.systemPackages = with pkgs; [
      tailscale
      tailscale-systray
    ];
    networking.firewall.allowedUDPPorts = [ config.services.tailscale.port ];
    services.tailscale = {
      enable = true;
      useRoutingFeatures = mkIf (cfg.configureClientRouting || cfg.configureServerRouting) (
        if (cfg.configureClientRouting && cfg.configureServerRouting) then
          "both"
        else
          (if cfg.configureClientRouting then "client" else "server")
      );
    };
  };
}
