It took me a while to figure out how to configure an auth proxy on Grafana in a NixOS config, turns out it was really easy. I was doing everything right except wrapping auth.proxy in quotes.

services.grafana = {
      ...
      "auth.proxy" = {
        enabled = true;
        header_name = "Tailscale-User-Login";
        header_property = "username";
        auto_sign_up = true;
        sync_ttl = 60;
        whitelist = "127.0.0.1";
        headers = "Email:Tailscale-User-Login Name:Tailscale-User-Name";
        enable_login_token = true;
      };
    };
  };