{ config, ... }:
{
  networking = {
    hostName = "tower";
    firewall = {
      checkReversePath = "loose";
      trustedInterfaces = [ "tailscale0" ];
      allowedUDPPorts = [ config.services.tailscale.port ];
    };
    useNetworkd = false;
    useDHCP = false;
  };
  systemd.network = {
    enable = true;
    networks = {
      "10-static" = {
        matchConfig.Name = "eno1";
        address = [ "172.19.96.2/24" ];
        gateway = [ "172.19.96.1" ];
        dns = [
          "1.1.1.1"
          "1.0.0.1"
        ];
      };
    };
  };

  services.tailscale = {
    enable = true;
    openFirewall = true;
  };
}