{ config, ... }:
{
  networking = {
    hostName = "tower";
    firewall = {
      checkReversePath = "loose";
      trustedInterfaces = [ "tailscale0" ];
      allowedUDPPorts = [ config.services.tailscale.port ];
    };
    useNetworkd = false;
    useDHCP = false;
  };
  systemd.network = {
    enable = true;
    networks = {
      "10-wan" = {
        matchConfig.Name = "enp1s0";
        address = [ "172.19.96.2/24" ];
        routes = [ { Gateway = "172.19.96.1"; } ];
      };
    };
  };


  services.tailscale = {
    enable = true;
    openFirewall = true;
  };
}