{ nixhelm, system, ... }: {
  kubernetes = {
    helm.releases.tailscale = {
      chart = nixhelm.chartsDerivations.${system}.tailscale.tailscale-operator;
      includeCRDs = true;
      namespace = "tailscale";
    };

    resources.secrets.operator-oauth.stringData = {
      client_id = "ref+sops://secrets/kubernetes.yaml#/tailscale/clientID";
      client_secret = "ref+sops://secrets/kubernetes.yaml#/tailscale/clientSecret";
    };
  };
}