{
  networking = {
    networkmanager = {
      enable = true;
      wifi = {
        powersave = true;
        scanRandMacAddress = true;
        # XXX https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1091
        #backend = "iwd";
        # Generate a random MAC for each WiFi and associate the two permanently.
        macAddress = "stable";
      };
      # Randomize MAC for every ethernet connetion
      ethernet.macAddress = "random";
      connectionConfig = {
        # IPv6 Privacy Extensions
        "ipv6.ip6-privacy" = 2;

        # unique DUID per connection
        "ipv6.dhcp-duid" = "stable-uuid";
      };
    };

    firewall = {
      enable = true;
      trustedInterfaces = ["tailscale0"];
    };
  };
}