diff --git a/cmd/ugitd/args.go b/cmd/ugitd/args.go
index b16fc0f40628e9b990ce045c15e1ab37584fa469..865deecb7c64f8b59fd2c17a601c5d9cc2ea466b 100644
--- a/cmd/ugitd/args.go
+++ b/cmd/ugitd/args.go
@@ -21,7 +21,6 @@ 	Tailscale tailscaleArgs
 }
 
 type sshArgs struct {
-	Enable         bool
 	AuthorizedKeys string
 	CloneURL       string
 	Port           int
@@ -29,7 +28,6 @@ 	HostKey        string
 }
 
 type httpArgs struct {
-	Enable   bool
 	CloneURL string
 	Port     int
 }
@@ -56,7 +54,6 @@ 	JSON  bool
 }
 
 type tailscaleArgs struct {
-	Enable   bool
 	Hostname string
 	DataDir  string
 }
@@ -68,14 +65,12 @@
 	c = cliArgs{
 		RepoDir: ".ugit",
 		SSH: sshArgs{
-			Enable:         true,
 			AuthorizedKeys: ".ssh/authorized_keys",
 			CloneURL:       "ssh://localhost:8448",
 			Port:           8448,
 			HostKey:        ".ssh/ugit_ed25519",
 		},
 		HTTP: httpArgs{
-			Enable:   true,
 			CloneURL: "http://localhost:8449",
 			Port:     8449,
 		},
@@ -87,7 +82,6 @@ 		Log: logArgs{
 			Level: log.InfoLevel,
 		},
 		Tailscale: tailscaleArgs{
-			Enable:   false,
 			Hostname: "ugit",
 			DataDir:  ".tsnet",
 		},
@@ -103,12 +97,10 @@ 		return nil
 	})
 	fs.BoolVar(&c.Log.JSON, "log.json", c.Log.JSON, "Print logs in JSON(L) format")
 	fs.StringVar(&c.RepoDir, "repo-dir", c.RepoDir, "Path to directory containing repositories")
-	fs.BoolVar(&c.SSH.Enable, "ssh.enable", c.SSH.Enable, "Enable SSH server")
 	fs.StringVar(&c.SSH.AuthorizedKeys, "ssh.authorized-keys", c.SSH.AuthorizedKeys, "Path to authorized_keys")
 	fs.StringVar(&c.SSH.CloneURL, "ssh.clone-url", c.SSH.CloneURL, "SSH clone URL base")
 	fs.IntVar(&c.SSH.Port, "ssh.port", c.SSH.Port, "SSH port")
 	fs.StringVar(&c.SSH.HostKey, "ssh.host-key", c.SSH.HostKey, "SSH host key (created if it doesn't exist)")
-	fs.BoolVar(&c.HTTP.Enable, "http.enable", c.HTTP.Enable, "Enable HTTP server")
 	fs.StringVar(&c.HTTP.CloneURL, "http.clone-url", c.HTTP.CloneURL, "HTTP clone URL base")
 	fs.IntVar(&c.HTTP.Port, "http.port", c.HTTP.Port, "HTTP port")
 	fs.StringVar(&c.Meta.Title, "meta.title", c.Meta.Title, "App title")
@@ -126,7 +118,6 @@ 			URL:  parts[1],
 		})
 		return nil
 	})
-	fs.BoolVar(&c.Tailscale.Enable, "tailscale.enable", c.Tailscale.Enable, "Enable Tailscale")
 	fs.StringVar(&c.Tailscale.Hostname, "tailscale.hostname", c.Tailscale.Hostname, "Tailscale host to show private repos on")
 	fs.StringVar(&c.Tailscale.DataDir, "tailscale.data-dir", c.Tailscale.DataDir, "Tailscale data/state directory")
 
diff --git a/cmd/ugitd/main.go b/cmd/ugitd/main.go
index f968711e64f1a8f8ff42e48d118e5c2dd266e2bb..0526a409744d994524911e58c79ed3e89f40cc24 100644
--- a/cmd/ugitd/main.go
+++ b/cmd/ugitd/main.go
@@ -62,25 +62,23 @@ 	if err := requiredFS(args.RepoDir); err != nil {
 		panic(err)
 	}
 
-	if args.SSH.Enable {
-		sshSettings := ssh.Settings{
-			AuthorizedKeys: args.SSH.AuthorizedKeys,
-			CloneURL:       args.SSH.CloneURL,
-			Port:           args.SSH.Port,
-			HostKey:        args.SSH.HostKey,
-			RepoDir:        args.RepoDir,
-		}
-		sshSrv, err := ssh.New(sshSettings)
-		if err != nil {
+	sshSettings := ssh.Settings{
+		AuthorizedKeys: args.SSH.AuthorizedKeys,
+		CloneURL:       args.SSH.CloneURL,
+		Port:           args.SSH.Port,
+		HostKey:        args.SSH.HostKey,
+		RepoDir:        args.RepoDir,
+	}
+	sshSrv, err := ssh.New(sshSettings)
+	if err != nil {
+		panic(err)
+	}
+	go func() {
+		log.Debugf("SSH listening on ssh://localhost:%d\n", sshSettings.Port)
+		if err := sshSrv.ListenAndServe(); err != nil {
 			panic(err)
 		}
-		go func() {
-			log.Debugf("SSH listening on ssh://localhost:%d\n", sshSettings.Port)
-			if err := sshSrv.ListenAndServe(); err != nil {
-				panic(err)
-			}
-		}()
-	}
+	}()
 
 	httpSettings := http.Settings{
 		Title:       args.Meta.Title,
@@ -100,17 +98,15 @@ 			Name: link.Name,
 			URL:  link.URL,
 		})
 	}
-	if args.HTTP.Enable {
-		httpSrv := http.New(httpSettings)
-		go func() {
-			log.Debugf("HTTP listening on http://localhost:%d\n", httpSettings.Port)
-			if err := httpSrv.ListenAndServe(); err != nil {
-				panic(err)
-			}
-		}()
-	}
+	httpSrv := http.New(httpSettings)
+	go func() {
+		log.Debugf("HTTP listening on http://localhost:%d\n", httpSettings.Port)
+		if err := httpSrv.ListenAndServe(); err != nil {
+			panic(err)
+		}
+	}()
 
-	if args.Tailscale.Enable {
+	if _, ok := os.LookupEnv("TS_AUTHKEY"); ok {
 		tailnetSettings := httpSettings
 		tailnetSettings.ShowPrivate = true
 		tailnetSrv := http.New(tailnetSettings)
diff --git a/flake.nix b/flake.nix
index b693a7a25666ae29a9f945bb776b84f42e8f4801..bf67a0f284186c24abc2176f46d84a9553f74779 100644
--- a/flake.nix
+++ b/flake.nix
@@ -76,9 +76,7 @@       yamlFormat = pkgs.formats.yaml {};
       configFile = pkgs.writeText "ugit.yaml" (builtins.readFile (yamlFormat.generate "ugit-yaml" cfg.config));
       authorizedKeysFile = pkgs.writeText "ugit_keys" (builtins.concatStringsSep "\n" cfg.authorizedKeys);
     in {
-      options = let
-        inherit (lib) mkEnableOption mkOption types;
-      in {
+      options = with lib; {
         services.ugit = {
           enable = mkEnableOption "Enable ugit";
 
@@ -86,12 +84,6 @@           package = mkOption {
             type = types.package;
             description = "ugit package to use";
             default = ugit;
-          };
-
-          tsAuthKey = mkOption {
-            type = types.str;
-            description = "Tailscale one-time auth-key";
-            default = "";
           };
 
           repoDir = mkOption {
@@ -163,12 +155,7 @@             authorizedKeysPath =
               if (builtins.length cfg.authorizedKeys) > 0
               then authorizedKeysFile
               else cfg.authorizedKeysFile;
-            args = [
-              "--config=${configFile}"
-              "--repo-dir=${cfg.repoDir}"
-              "--ssh.authorized-keys=${authorizedKeysPath}"
-              "--ssh.host-key=${cfg.hostKeyFile}"
-            ];
+            args = ["--config=${configFile}" "--repo-dir=${cfg.repoDir}" "--ssh.authorized-keys=${authorizedKeysPath}" "--ssh.host-key=${cfg.hostKeyFile}"];
           in "${cfg.package}/bin/ugitd ${builtins.concatStringsSep " " args}";
           wantedBy = ["multi-user.target"];
           after = ["network.target"];
@@ -179,7 +166,6 @@             Group = cfg.group;
             Restart = "always";
             RestartSec = "15";
             WorkingDirectory = "/var/lib/ugit";
-            Environment = ["TS_AUTHKEY=${cfg.tsAuthKey}"];
           };
         };
       };