{ config, ... }:
let
  tailscale = "${config.services.tailscale.package}/bin/tailscale";
in
{
  # berry takes the node's HTTPS name at the root, where its client expects to live
  systemd.services.tailscale-serve-berry = {
    description = "Expose berry to the tailnet";
    wantedBy = [ "multi-user.target" ];
    requires = [ "tailscaled.service" ];
    after = [ "tailscaled.service" ];
    serviceConfig = {
      ExecStartPre = "${tailscale} wait --timeout=60s";
      ExecStart = "${tailscale} serve --yes --https=443 http://127.0.0.1:8787";
      Restart = "on-failure";
      RestartSec = 1;
    };
  };
}