diff --git a/CLAUDE.md b/CLAUDE.md
index 8b22cb9..17baba6 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -56,9 +56,9 @@ if config.isMacOS then [ ] else [ pkgs.mold ]
 
 ### System Modules
 
-- `/tasks/` - Shared NixOS modules (auto-upgrade, garbage collection)
-- `/programs/` - System-wide programs (nixvim)
-- `/services/` - Server services (minecraft, factorio, mediawiki)
+- `/tasks/` - Shared NixOS modules
+- `/programs/` - System-wide programs
+- `/services/` - Server services
 
 ### Flake Structure
 
diff --git a/README.md b/README.md
index 0a19710..05ede76 100644
--- a/README.md
+++ b/README.md
@@ -9,9 +9,17 @@
 
 To switch to a specific machine, e.g. merlow, use `github:bates64/nixfiles#merlow` as the flake URI.
 
-### (macOS) home-manager only
+### home-manager
 
-1. [Install Nix and enable flakes](https://docs.determinate.systems/getting-started/)
+1. Install Nix and enable flakes
 2. Install home-manager: `nix run home-manager/master -- init --switch`
 3. Restart shell
 4. Switch to this flake: `nix run home-manager/master -- switch --flake github:bates64/nixfiles`
+
+## Networking
+
+Tailscale mesh VPN connects NixOS hosts on a private network. Authenticate once per machine:
+```bash
+sudo tailscale up --accept-dns
+```
+Then SSH between hosts should Just Work.
diff --git a/flake.nix b/flake.nix
index ebc28c6..114f014 100644
--- a/flake.nix
+++ b/flake.nix
@@ -136,6 +136,8 @@
             {
               services.vscode-server.enable = true;
             }
+
+            ./services/tailscale.nix
           ];
         };
         # Hetzner VPS
@@ -172,6 +174,8 @@
             ./services/matchbox.nix
             ./services/minecraft/vanilla.nix
             ./services/minecraft/gtnh
+
+            ./services/tailscale.nix
           ];
         };
       };
diff --git a/services/tailscale.nix b/services/tailscale.nix
new file mode 100644
index 0000000..1bb7ca1
--- /dev/null
+++ b/services/tailscale.nix
@@ -0,0 +1,14 @@
+{ config, pkgs, ... }:
+{
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "client";
+  };
+
+  # Required for Tailscale
+  networking.firewall = {
+    checkReversePath = "loose";
+    trustedInterfaces = [ "tailscale0" ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
+  };
+}