{
  config,
  pkgs,
  lib,
  inputs,
  xinlib,
  ...
}: let
  tailnetACLs = let
    acls = {
      hosts = {
        europa = "100.92.31.80";
        startpage = "100.120.84.116";
        startdev = "100.92.56.119";
        go = "100.117.47.51";
        nbc = "100.122.61.43"; # nix-binary-cache
        console = "100.87.112.70";
        box = "100.120.151.126";
      };

      tagOwners = {
        "tag:untrusted" = ["qbit@github"];
        "tag:minservice" = ["qbit@github"];
        "tag:sshonly" = ["qbit@github"];
        "tag:apper" = ["qbit@github"];
        "tag:golink" = ["qbit@github"];
        "tag:lab" = ["qbit@github"];
      };

      acls = [
        {
          action = "accept";
          src = ["tag:untrusted"];
          dst = [
            "europa:22"
            "europa:12304"
            "startpage:443"
            "startdev:443"
            "go:80"
            "tag:lab:22"
            "nbc:443"
          ];
        }
        {
          action = "accept";
          src = ["tag:minservice" "tag:sshonly"];
          dst = ["*:22" "box:3030" "nbc:443" "console:2222"];
        }
        {
          action = "accept";
          src = ["qbit@github"];
          dst = ["*:*"];
        }
      ];
    };
  in
    pkgs.writeTextFile {
      name = "tailnet-acls.json";
      text = builtins.toJSON acls;
    };
  aclUpdateScript = pkgs.writeShellScriptBin "tailnet-acl-updater" ''
    set -eu

    . ${config.sops.secrets.po_env.path}

    JQ=${pkgs.jq}/bin/jq
    PO=${inputs.po.packages.${pkgs.system}.po}/bin/po

    APIURL="https://api.tailscale.com/api/v2/tailnet/-/acl"
    TOKEN="$(cat ${config.sops.secrets.tailnet_acl_manager.path}):"

    ERROR="$(${pkgs.curl}/bin/curl "$APIURL/validate" -u "$TOKEN" -d @${tailnetACLs} | $JQ -r .message)"

    if [ "$ERROR" = "null" ]; then
      RESP="$(${pkgs.curl}/bin/curl "$APIURL" -u "$TOKEN" -d @${tailnetACLs} | $JQ -r .message)"
      if [ "$RESP" != "null" ]; then
        $PO -title "Failed to update TailNet!" -body "$RESP"
      fi
    fi
  '';
  jobs = [
    {
      name = "update-talenet-acls";
      script = "${aclUpdateScript}/bin/tailnet-acl-updater";
      startAt = "*:30:00";
      path = [];
      inherit (config.nixManager) user;
    }
  ];
  enabled = config.nixManager.enable;
in
  with lib; {
    sops.secrets = mkIf enabled {
      tailnet_acl_manager = {
        owner = config.nixManager.user;
        sopsFile = config.xin-secrets.manager;
      };
      po_env = {
        owner = config.nixManager.user;
        sopsFile = config.xin-secrets.manager;
      };
    };
    systemd.services = mkIf enabled (listToAttrs (builtins.map xinlib.jobToService jobs));
  }