Add Tailscale support for macOS and Linux - #374
Conversation
- Add tailscale cask to Homebrew config for macOS - Create tailscale service module for home-manager (Linux) - Enable services.tailscale in NixOS configuration
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. 📝 WalkthroughSummary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughThe pull request adds the tailscale package to two configuration files: adding it to the Homebrew casks list in nix-darwin and including it in home-manager packages with conditional Linux availability. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~5 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro Disabled knowledge base sources:
📒 Files selected for processing (1)
🧰 Additional context used📓 Path-based instructions (3)**/*.nix📄 CodeRabbit inference engine (CLAUDE.md)
Files:
**/default.nix📄 CodeRabbit inference engine (CLAUDE.md)
Files:
home-manager/**/*.nix📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
Files:
🧠 Learnings (2)📓 Common learnings📚 Learning: 2025-11-25T09:34:55.014ZApplied to files:
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (10)
🔇 Additional comments (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @shunkakinoki, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the configuration by integrating Tailscale across various operating systems. It ensures that Tailscale can be consistently managed and deployed, whether on macOS via Homebrew, on Linux through home-manager for user-level tools, or as a fully enabled system service on NixOS. The changes streamline secure network access and management within the existing infrastructure. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Mesa DescriptionTL;DRAdds Tailscale support for macOS and Linux, enabling secure VPN and SSH access by installing the macOS cask and integrating it into Home Manager for Linux. What changed?
Description generated by Mesa. Update settings |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds support for Tailscale across macOS, NixOS, and non-NixOS Linux environments, which is a great addition. The changes are well-structured, with separate configurations for each platform.
My review includes two main points:
- A logic correction in the new
home-managermodule for Tailscale to prevent redundant package installation on NixOS systems. This is an important fix to ensure the configuration is clean and correct. - A minor style suggestion to maintain alphabetical order in the Homebrew cask list for better readability and consistency.
Overall, the changes are good, and with the suggested improvements, the implementation will be more robust.
| { pkgs }: | ||
| let | ||
| inherit (pkgs) lib; | ||
| in | ||
| # On macOS, Tailscale is installed via Homebrew cask which manages the app and daemon. | ||
| # On Linux (non-NixOS), we install the CLI tools; the tailscaled daemon requires system-level setup. | ||
| # For NixOS, enable services.tailscale in the system configuration. | ||
| lib.mkIf pkgs.stdenv.isLinux { | ||
| home.packages = [ pkgs.tailscale ]; | ||
| } |
There was a problem hiding this comment.
The current implementation of this module will cause the tailscale package to be installed redundantly on NixOS systems. The system-level services.tailscale.enable = true; option already ensures the package is installed. The comment in the file correctly states the desired behavior, but the lib.mkIf pkgs.stdenv.isLinux condition is too broad as it also matches NixOS.
To fix this, the module should be refactored to be a proper home-manager module function. This allows it to access the config object from the module system and conditionally install the package only on non-NixOS Linux systems by inspecting the config object. This aligns with the intent described in the comments and avoids package redundancy.
{ pkgs }:
{ lib, config, ... }:
{
# On macOS, Tailscale is installed via Homebrew cask which manages the app and daemon.
# On Linux (non-NixOS), we install the CLI tools; the tailscaled daemon requires system-level setup.
# For NixOS, enable services.tailscale in the system configuration.
home.packages = lib.mkIf (pkgs.stdenv.isLinux && !(config.system ? stateVersion)) [
pkgs.tailscale
];
}
| "windsurf" | ||
| "zed" | ||
| "zoom" | ||
| "tailscale" |
There was a problem hiding this comment.
For consistency and easier maintenance, the items in the casks list should be kept in alphabetical order. Please move "tailscale" to its correct sorted position in the list (after "slack").
There was a problem hiding this comment.
Pull request overview
This PR adds Tailscale VPN support across all platforms in the dotfiles configuration: macOS via Homebrew cask, NixOS via system services, and non-NixOS Linux via home-manager packages.
Key changes:
- Added Tailscale cask to Homebrew configuration for macOS
- Enabled
services.tailscalein NixOS system configuration - Created conditional home-manager module to install Tailscale CLI on Linux (non-NixOS) systems
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| nix-darwin/config/homebrew.nix | Adds "tailscale" cask to install Tailscale app on macOS |
| hosts/nixos/default.nix | Enables Tailscale service for NixOS systems with explanatory comment |
| home-manager/services/tailscale/default.nix | New module that conditionally installs Tailscale CLI tools on Linux (non-NixOS) systems |
| home-manager/services/default.nix | Imports and includes the new Tailscale module in the services list |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "windsurf" | ||
| "zed" | ||
| "zoom" | ||
| "tailscale" |
There was a problem hiding this comment.
The casks list appears to be alphabetically sorted. "tailscale" should be placed after "slack" (line 80) and before "visual-studio-code" (line 81) to maintain alphabetical order.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
nix-darwin/config/homebrew.nix (1)
88-88: Consider maintaining alphabetical order in the casks list.The "tailscale" cask is added at the end of the list, but the list appears to be alphabetically sorted. For consistency, "tailscale" should be positioned between "sf-symbols" (line 79) and "visual-studio-code" (line 81).
Apply this diff to maintain alphabetical order:
"sf-symbols" "slack" + "tailscale" "visual-studio-code" "vscodium" "warp" "wezterm" "windsurf" "zed" "zoom" - "tailscale"As per coding guidelines, attribute sets and lists should be sorted alphabetically in Nix files.
home-manager/services/tailscale/default.nix (1)
1-10: Consider enhancing module documentation and structure.The module correctly handles platform-specific Tailscale installation (Homebrew on macOS, package on Linux, system service on NixOS). However, the module structure is unconventional for a home-manager service module:
Documentation: The comments explain platform-specific installation but could be more comprehensive. Consider adding:
- Module purpose and usage guidelines
- When users should enable this vs. system-level configuration
- Dependencies and prerequisites
Module Structure: The current implementation directly returns a conditional attribute set rather than following the typical home-manager module pattern with
configandoptionsdeclarations. While this works for simple package installation, it doesn't provide:
- Configurable options (no
mkOptionusage)- Type safety for module inputs
- User-facing enable/disable toggle
Recommendation: If this is consistent with other service modules in your codebase (e.g., code-syncer, dotfiles-updater), this pattern may be acceptable. Otherwise, consider refactoring to follow standard home-manager module conventions.
As per coding guidelines, service configurations should include proper service definitions, handle dependencies correctly, and document service parameters. Consider this structure:
{ config, lib, pkgs, ... }: let cfg = config.services.tailscale; in { options.services.tailscale = { enable = lib.mkEnableOption "Tailscale VPN integration (Linux package only)"; }; config = lib.mkIf (cfg.enable && pkgs.stdenv.isLinux) { # On macOS, Tailscale is installed via Homebrew cask which manages the app and daemon. # On Linux (non-NixOS), we install the CLI tools; the tailscaled daemon requires system-level setup. # For NixOS, enable services.tailscale in the system configuration. home.packages = [ pkgs.tailscale ]; }; }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (4)
home-manager/services/default.nix(1 hunks)home-manager/services/tailscale/default.nix(1 hunks)hosts/nixos/default.nix(1 hunks)nix-darwin/config/homebrew.nix(1 hunks)
🧰 Additional context used
📓 Path-based instructions (7)
**/*.nix
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.nix: Use nixfmt for formatting all Nix files
Document complex configurations with comments in Nix files
**/*.nix: Use 2 spaces for indentation in Nix files
Keep line length under 100 characters in Nix files
Sort attribute sets alphabetically in Nix files
Use consistent spacing around operators in Nix files
Format lists and sets consistently in Nix filesUse treefmt.toml for formatting Nix files
**/*.nix: UsemkOptionfor configurable options in Nix modules
Implement proper typing for all options in Nix modules
Follow the Nix expression language style guide
Files:
home-manager/services/default.nixhosts/nixos/default.nixnix-darwin/config/homebrew.nixhome-manager/services/tailscale/default.nix
**/default.nix
📄 CodeRabbit inference engine (CLAUDE.md)
Use
default.nixfiles for module exports
Files:
home-manager/services/default.nixhosts/nixos/default.nixhome-manager/services/tailscale/default.nix
home-manager/services/**/default.nix
📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
Service configurations must include proper service definitions, handle dependencies correctly, and document service parameters
Files:
home-manager/services/default.nixhome-manager/services/tailscale/default.nix
home-manager/**/*.nix
📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
home-manager/**/*.nix: Use typed options whenever possible in Nix configurations
Document all configuration options in Nix modules and programs
Follow home-manager's module structure and keep configurations modular
Use proper indentation and formatting in Nix configuration files
Files:
home-manager/services/default.nixhome-manager/services/tailscale/default.nix
home-manager/services/**/*.nix
📄 CodeRabbit inference engine (.cursor/rules/nix.mdc)
Service configurations in
home-manager/services/should follow systemd service conventions, include proper service dependencies, and have clear documentation for service parameters
Files:
home-manager/services/default.nixhome-manager/services/tailscale/default.nix
nix-darwin/**/*.nix
📄 CodeRabbit inference engine (CLAUDE.md)
Use Homebrew only for macOS-specific applications
Files:
nix-darwin/config/homebrew.nix
home-manager/services/*/default.nix
📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
Service configurations should be located in
home-manager/services/<name>/with proper service definitions and correct dependency handling
Files:
home-manager/services/tailscale/default.nix
🧠 Learnings (14)
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/services/**/default.nix : Service configurations must include proper service definitions, handle dependencies correctly, and document service parameters
Applied to files:
home-manager/services/default.nixhosts/nixos/default.nixhome-manager/services/tailscale/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/services/*/default.nix : Service configurations should be located in `home-manager/services/<name>/` with proper service definitions and correct dependency handling
Applied to files:
home-manager/services/default.nix
📚 Learning: 2025-11-25T09:35:01.066Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/nix.mdc:0-0
Timestamp: 2025-11-25T09:35:01.066Z
Learning: Applies to home-manager/services/**/*.nix : Service configurations in `home-manager/services/` should follow systemd service conventions, include proper service dependencies, and have clear documentation for service parameters
Applied to files:
home-manager/services/default.nixhome-manager/services/tailscale/default.nix
📚 Learning: 2025-11-25T09:34:23.224Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-25T09:34:23.224Z
Learning: Prefer Nix packages over external package managers
Applied to files:
home-manager/services/default.nixhome-manager/services/tailscale/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/programs/**/*.nix : Follow program-specific best practices in program configuration files
Applied to files:
home-manager/services/default.nixhome-manager/services/tailscale/default.nix
📚 Learning: 2025-11-25T09:34:23.224Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-25T09:34:23.224Z
Learning: Applies to nix-darwin/**/*.nix : Use Homebrew only for macOS-specific applications
Applied to files:
nix-darwin/config/homebrew.nixhome-manager/services/tailscale/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/**/*.nix : Follow home-manager's module structure and keep configurations modular
Applied to files:
home-manager/services/tailscale/default.nix
📚 Learning: 2025-11-25T09:35:01.066Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/nix.mdc:0-0
Timestamp: 2025-11-25T09:35:01.066Z
Learning: Applies to home-manager/modules/**/*.nix : Document all custom modules and options
Applied to files:
home-manager/services/tailscale/default.nix
📚 Learning: 2025-11-25T09:35:01.066Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/nix.mdc:0-0
Timestamp: 2025-11-25T09:35:01.066Z
Learning: Applies to home-manager/modules/**/default.nix : Each module in `home-manager/modules/` should have a clear `default.nix` with proper option declarations following the home-manager module structure
Applied to files:
home-manager/services/tailscale/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/**/*.nix : Document all configuration options in Nix modules and programs
Applied to files:
home-manager/services/tailscale/default.nix
📚 Learning: 2025-11-25T09:34:23.224Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-25T09:34:23.224Z
Learning: Applies to **/default.nix : Use `default.nix` files for module exports
Applied to files:
home-manager/services/tailscale/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/modules/*/default.nix : Custom modules must be located in `home-manager/modules/<name>/` and must include a `default.nix` file
Applied to files:
home-manager/services/tailscale/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/modules/**/default.nix : Custom modules should include proper option types and document all options
Applied to files:
home-manager/services/tailscale/default.nix
📚 Learning: 2025-11-25T09:35:01.066Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/nix.mdc:0-0
Timestamp: 2025-11-25T09:35:01.066Z
Learning: Applies to home-manager/programs/**/*.nix : Program configurations in `home-manager/programs/` should be organized by program name, include all necessary dependencies, use `home.packages` for package installations, and use `programs.<name>` when available in home-manager
Applied to files:
home-manager/services/tailscale/default.nix
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (13)
- GitHub Check: Mesa Review
- GitHub Check: cubic · AI code reviewer
- GitHub Check: Agent
- GitHub Check: docker-build-push (linux/arm64, arm64, ubuntu-24.04-arm)
- GitHub Check: docker-build-push (linux/amd64, amd64, ubuntu-latest)
- GitHub Check: nix-nixos
- GitHub Check: nix-linux
- GitHub Check: lua-neovim
- GitHub Check: lua-hammerspoon
- GitHub Check: nix-darwin
- GitHub Check: e2e-run (NixOS, ubuntu-latest)
- GitHub Check: e2e-run (MacOS, macos-latest)
- GitHub Check: e2e-run (Ubuntu, ubuntu-latest)
🔇 Additional comments (2)
home-manager/services/default.nix (1)
8-8: LGTM! Proper module integration.The tailscale module is correctly imported and integrated into the services list, maintaining alphabetical order in both the let-binding and the returned list.
Also applies to: 16-16
hosts/nixos/default.nix (1)
97-98: LGTM! Proper NixOS service enablement.The Tailscale service is correctly enabled for NixOS with a clear comment explaining its purpose. This follows the standard NixOS service configuration pattern.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![mesa-dot-dev[bot]](https://avatars.githubusercontent.com/in/1050077?s=60&v=4){kind=small}
There was a problem hiding this comment.
Performed full review of a666480...f94fda5
Analysis
-
Redundant Installation on NixOS: The PR enables Tailscale both at the NixOS system level and through the home-manager module, creating unnecessary duplication and potential version conflicts. The home-manager module should be refined to distinguish between standalone Linux and NixOS.
-
Incomplete Linux Setup: For standalone Linux systems, the implementation only installs Tailscale CLI tools without addressing the daemon configuration, which requires system-level setup. This leaves users with a non-functional installation unless they separately configure tailscaled.
-
Platform-Specific Logic Improvements: While the PR correctly handles the three-tier platform architecture, the conditional logic in home-manager/services/tailscale/default.nix needs refinement to avoid the NixOS overlap.
-
Missing User Guidance: No explicit activation script or post-install guidance is provided for Linux users who need daemon setup instructions.
Tip
Help
Slash Commands:
/review- Request a full code review/review latest- Review only changes since the last review/describe- Generate PR description. This will update the PR body or issue comment depending on your configuration/help- Get help with Mesa commands and configuration options
4 files reviewed | 1 comments | Edit Agent Settings • Read Docs
| # On macOS, Tailscale is installed via Homebrew cask which manages the app and daemon. | ||
| # On Linux (non-NixOS), we install the CLI tools; the tailscaled daemon requires system-level setup. | ||
| # For NixOS, enable services.tailscale in the system configuration. | ||
| lib.mkIf pkgs.stdenv.isLinux { |
There was a problem hiding this comment.
The condition pkgs.stdenv.isLinux will match both standalone Linux systems and NixOS. However, on NixOS hosts, services.tailscale.enable = true (in hosts/nixos/default.nix:98) already installs the tailscale package system-wide. This creates redundant package installation in both system and user profiles.
Consider refining the condition to exclude NixOS:
lib.mkIf (pkgs.stdenv.isLinux && !(builtins.pathExists /etc/NIXOS)) {
home.packages = [ pkgs.tailscale ];
}This ensures standalone Linux users get CLI tools via home-manager, while NixOS users rely solely on the system service installation.
Agent: 🏛 Architecture
Summary by cubic
Enable Tailscale on macOS and Linux to provide secure VPN and SSH access. Installs the macOS cask and adds Tailscale to Home Manager packages.
Written for commit 840ca3d. Summary will update automatically on new commits.