Tailscale is pretty straightforward because they have a config for it baked in, pretty sure it’s just services.tailscale.enable = true. But if you use it with the operator=$USER setting, note that you still need to run tailscale with sudo for your initial login before that works properly