{ ... }: {
  networking = {
    firewall = {
      enable = true;
      allowedTCPPorts = [
        1443  # Headscale DERP (tcp)
      ];
      allowedUDPPorts = [
        3478  # Headscale DERP (udp)
      ];
    };
  };
}