setup automatic tailscale connection

.gitattributes

@@ -0,0 +1 @@
+*.key filter=git-crypt diff=git-crypt

kiosk.nix

@@ -35,4 +35,20 @@ in
     enable = true;
     pulse.enable = true;
   };
+
+  services.tailscale = {
+    enable = true;
+    extraUpFlags = [ "--advertise-tags" "tag:kiosk" ];
+    authKeyFile = ./tailscale-client-secret.key;
+    authKeyParameters.ephemeral = false;
+    openFirewall = true;
+  };
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = "yes";
+    };
+  };
 }