When Exit Node is enabled, it has to be again explicitly manually approved from Tailscale org console

[oycyc]

https://tailscale.com/kb/1103/exit-nodes

exit_node_enabled = true

This is reflected in the Tailscale console:

But I have to explicitly go into that machine's Tailscale route settings to actually enable it.

The flag only allows it, but I have to go through the additional step on the Tailscale console to enable it. Since we're already using the Tailscale provider, maybe there's a programmatic way to enable it once the instance is online.

[oycyc]

Maybe not related to this specific Terraform module, but this can also be accomplished via policies:
allowing "exitNode": ["tag:subnet-router"], or whatever yoru tag is, under "autoApprovers"

[oycyc]

https://tailscale.com/docs/reference/syntax/policy-file#auto-approvers

[oycyc]

[oycyc]

e.g.