{
  config,
  lib,
  pkgs,
  ...
}: {
  services.tailscale = {
    enable = true;
    useRoutingFeatures = "both";
    openFirewall = true;
  };

  boot.kernel.sysctl = {
    "net.ipv4.ip_forward" = 1;
    "net.ipv6.conf.all.forwarding" = 1;
  };

  services.networkd-dispatcher = lib.mkIf (config.networking.useNetworkd || config.systemd.network.enable) {
    enable = true;
    rules."50-tailscale-optimizations" = {
      onState = ["routable"];
      script = ''
        ${pkgs.ethtool}/bin/ethtool -K "$IFACE" \
          rx-udp-gro-forwarding on \
          rx-gro-list off
      '';
    };
  };
}