From dfbc3540e6df3661d34f2b000dd234d64a14beb7 Mon Sep 17 00:00:00 2001
From: Joshua Yuen <joshuayuen99@gmail.com>
Date: Mon, 28 Sep 2026 13:25:14 -0400
Subject: [PATCH] Add resolved when tailscale is enabled so that DNS works
 properly

---
 modules/nixos/network.nix   | 9 ++++++++-
 modules/nixos/tailscale.nix | 7 +++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/modules/nixos/network.nix b/modules/nixos/network.nix
index fce7b48..9c948d9 100644
--- a/modules/nixos/network.nix
+++ b/modules/nixos/network.nix
@@ -1,12 +1,19 @@
 {
   host,
+  config,
+  lib,
   pkgs,
   ...
 }:
 {
   networking = {
     hostName = "${host}";
-    networkmanager.enable = true;
+    networkmanager = {
+      enable = true;
+      # resolved is only enabled when tailscale is; pointing NM at a
+      # systemd-resolved that isn't running would break DNS entirely
+      dns = lib.mkIf config.services.resolved.enable "systemd-resolved";
+    };
     wireless.enable = true;
   };
 
diff --git a/modules/nixos/tailscale.nix b/modules/nixos/tailscale.nix
index 781bcbf..ee15a68 100644
--- a/modules/nixos/tailscale.nix
+++ b/modules/nixos/tailscale.nix
@@ -10,5 +10,12 @@ in
 {
   config = mkIf cfg.enable {
     services.tailscale.enable = true;
+
+    # systemd-resolved is needed for tailscale's MagicDNS to work properly
+    services.resolved.enable = true;
+
+    # tailscaled applies its DNS config (split DNS, MagicDNS) to
+    # systemd-resolved over D-Bus, which is polkit-guarded
+    security.polkit.enable = true;
   };
 }