# tailscale0 inherits net.ipv6.conf.default.disable_ipv6=1 (/etc/sysctl.conf)
# at creation, so tailscaled cannot add its fd7a:115c:a1e0::6/128 mesh address
# and logs "permission denied" forever. This re-enables IPv6 on that ONE
# interface, after it exists — a /etc/sysctl.d entry runs at boot, before
# tailscale0 is created, and is silently ignored.
#
# Scoped deliberately: the global default stays as-is so Docker bridges on this
# host keep their current (no-IPv6) behaviour.
[Service]
ExecStartPost=/bin/sh -c 'for i in 1 2 3 4 5 6 7 8 9 10; do if [ -e /sys/class/net/tailscale0 ]; then sysctl -qw net.ipv6.conf.tailscale0.disable_ipv6=0; exit 0; fi; sleep 1; done; exit 0'