navidrome: Add Tailscale auth key

modules/nixos/navidrome.nix

@@ -1,3 +1,4 @@
+{ inputs, ... }:
 {
   containers.music = {
     autoStart = true;
@@ -8,7 +9,20 @@
       };
     };
 
-    config = {
+    config =
+      { config, ... }:
+      {
+        imports = [ inputs.agenix.nixosModules.default ];
+
+        age = {
+          identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+          secrets."tailscale" = {
+            file = ../secrets/tailscale.age;
+            mode = "400";
+            owner = "tailscale";
+          };
+        };
+
         services = {
           navidrome = {
             enable = true;
@@ -22,6 +36,7 @@
             enable = true;
             useRoutingFeatures = "server";
             interfaceName = "userspace-networking";
+            authKeyFile = config.age.secrets.tailscale.path;
           };
         };
 

modules/secrets/secrets.nix

@@ -9,4 +9,5 @@ in
 {
   "nextcloud.age".publicKeys = all;
   "forgejo-runner-token.age".publicKeys = all;
+  "tailscale.age".publicKeys = all;
 }