From b10b8846883e20f78b1c9d72ca691dee1dbe7ecb Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Sun, 2 Mar 2025 22:10:00 +0000
Subject: [PATCH 1/3] tailscale: move back to buildGoModule

---
 pkgs/by-name/ta/tailscale/package.nix | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/ta/tailscale/package.nix b/pkgs/by-name/ta/tailscale/package.nix
index 1a07ba95d71e..ef69761a98e5 100644
--- a/pkgs/by-name/ta/tailscale/package.nix
+++ b/pkgs/by-name/ta/tailscale/package.nix
@@ -1,25 +1,30 @@
 {
   lib,
   stdenv,
-  buildGo123Module,
+
+  buildGoModule,
   fetchFromGitHub,
   fetchpatch,
+
   makeWrapper,
+  installShellFiles,
+  # runtime tooling - linux
   getent,
   iproute2,
   iptables,
-  lsof,
   shadow,
   procps,
+  # runtime tooling - darwin
+  lsof,
+
   nixosTests,
-  installShellFiles,
   tailscale-nginx-auth,
 }:
 
 let
   version = "1.80.2";
 in
-buildGo123Module {
+buildGoModule {
   pname = "tailscale";
   inherit version;
 
@@ -93,9 +98,9 @@ buildGo123Module {
       wrapProgram $out/bin/tailscaled \
         --prefix PATH : ${
           lib.makeBinPath [
+            getent
             iproute2
             iptables
-            getent
             shadow
           ]
         } \
@@ -116,13 +121,13 @@ buildGo123Module {
     inherit tailscale-nginx-auth;
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://tailscale.com";
     description = "Node agent for Tailscale, a mesh VPN built on WireGuard";
     changelog = "https://github.com/tailscale/tailscale/releases/tag/v${version}";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
     mainProgram = "tailscale";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       mbaillie
       jk
       mfrw

From a0ec8cf1e4c363926e85d2c6aaed3b1fbd00152f Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Sun, 2 Mar 2025 22:11:04 +0000
Subject: [PATCH 2/3] tailscale-nginx-auth: move back to buildGoModule

---
 pkgs/by-name/ta/tailscale-nginx-auth/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ta/tailscale-nginx-auth/package.nix b/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
index 5a5f8e354447..50d5d8e577e4 100644
--- a/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
+++ b/pkgs/by-name/ta/tailscale-nginx-auth/package.nix
@@ -1,11 +1,11 @@
 {
   lib,
   stdenv,
-  buildGo123Module,
+  buildGoModule,
   tailscale,
 }:
 
-buildGo123Module {
+buildGoModule {
   pname = "tailscale-nginx-auth";
   inherit (tailscale) version src vendorHash;
 
@@ -27,11 +27,11 @@ buildGo123Module {
     install -D -m0444 -t $out/lib/systemd/system ./cmd/nginx-auth/tailscale.nginx-auth.socket
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://tailscale.com";
     description = "Tool that allows users to use Tailscale Whois authentication with NGINX as a reverse proxy";
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
     mainProgram = "tailscale.nginx-auth";
-    maintainers = with maintainers; [ phaer ];
+    maintainers = with lib.maintainers; [ phaer ];
   };
 }

From 079c28fb814d4f6355e8a1e4a59c340d6eb3ca3e Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Sun, 2 Mar 2025 22:12:08 +0000
Subject: [PATCH 3/3] tailscale: re-enable tests

---
 pkgs/by-name/ta/tailscale/package.nix | 60 ++++++++++++++++++++++++++-
 1 file changed, 59 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ta/tailscale/package.nix b/pkgs/by-name/ta/tailscale/package.nix
index ef69761a98e5..09543aff6e65 100644
--- a/pkgs/by-name/ta/tailscale/package.nix
+++ b/pkgs/by-name/ta/tailscale/package.nix
@@ -65,6 +65,12 @@ buildGoModule {
     "cmd/tsidp"
   ];
 
+  excludedPackages = [
+    # exlude integration tests which fail to work
+    # and require additional tooling
+    "tstest/integration"
+  ];
+
   ldflags = [
     "-w"
     "-s"
@@ -76,7 +82,59 @@ buildGoModule {
     "ts_include_cli"
   ];
 
-  doCheck = false;
+  # remove vendored tooling to ensure it's not used
+  # also avoids some unnecessary tests
+  preBuild = ''
+    rm -rf ./tool
+  '';
+
+  preCheck = ''
+    # feed in all tests for testing
+    # subPackages above limits what is built to just what we
+    # want but also limits the tests
+    unset subPackages
+
+    # several tests hang
+    rm tsnet/tsnet_test.go
+  '';
+
+  checkFlags =
+    let
+      skippedTests = [
+        # dislikes vendoring
+        "TestPackageDocs" # .
+        # tries to start tailscaled
+        "TestContainerBoot" # cmd/containerboot
+
+        # just part of a tool which generates yaml for k8s CRDs
+        # requires helm
+        "Test_generate" # cmd/k8s-operator/generate
+        # self reported potentially flakey test
+        "TestConnMemoryOverhead" # control/controlbase
+
+        # interacts with `/proc/net/route` and need a default route
+        "TestDefaultRouteInterface" # net/netmon
+        "TestRouteLinuxNetlink" # net/netmon
+        "TestGetRouteTable" # net/routetable
+
+        # remote udp call to 8.8.8.8
+        "TestDefaultInterfacePortable" # net/netutil
+
+        # launches an ssh server which works when provided openssh
+        # also requires executing commands but nixbld user has /noshell
+        "TestSSH" # ssh/tailssh
+        # wants users alice & ubuntu
+        "TestMultipleRecorders" # ssh/tailssh
+        "TestSSHAuthFlow" # ssh/tailssh
+        "TestSSHRecordingCancelsSessionsOnUploadFailure" # ssh/tailssh
+        "TestSSHRecordingNonInteractive" # ssh/tailssh
+
+        # test for a dev util which helps to fork golang.org/x/crypto/acme
+        # not necessary and fails to match
+        "TestSyncedToUpstream" # tempfork/acme
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
   postInstall =
     ''