diff --git a/modules/nixos/tailscale/default.nix b/modules/nixos/tailscale/default.nix
new file mode 100644
index 0000000..4ae39d9
--- /dev/null
+++ b/modules/nixos/tailscale/default.nix
@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.chimera.networking.tailscale;
+in {
+  options.chimera.networking.tailscale = {
+    enable = lib.mkOption {
+      description = "Enable tailscale for this system";
+      default = true;
+      type = lib.types.bool;
+    };
+    runExitNode.enable = lib.mkEnableOption "Enable this system as an exit node on the tailnet";
+    server = lib.mkOption {
+      description = "Set where your control plane server is";
+      default = "https://clicks.domains";
+      example = "https://controlplane.tailscale.com";
+    };
+    authKeyFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      description = "Path to key file for tailscale";
+      default = null;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.tailscale = {
+      enable = true;
+      useRoutingFeatures = if cfg.runExitNode.enable then "server" else "client";
+      extraUpFlags = [
+        "--login-server=${cfg.server}"
+        "--accept-routes"
+        "--ssh"
+      ] ++ (if cfg.runExitNode.enable then [
+        "--advertise-exit-node"
+        "--exit-node-allow-lan-access"
+      ] else []);
+      authKeyFile = lib.mkIf (cfg.authKeyFile != null) cfg.authKeyFile;
+    };
+  };
+}