{
  networking.nameservers = [ "100.100.100.100" "1.1.1.1" "8.8.8.8" ];
  networking.search = [ "hummingbird-stork.ts.net" ];
  services.tailscale = {
    enable = true;
    useRoutingFeatures = "both";
    extraUpFlags = [ "--ssh" ];
  };
  # Tell the firewall to implicitly trust packets routed over Tailscale:
  networking.firewall.trustedInterfaces = [ "tailscale0" ];
}