{
  config,
  lib,
  ...
}:
{
  networking.domain = "home.arpa";

  services.openssh = {
    enable = true;
    openFirewall = lib.mkDefault (
      # default to open for new machines until firewall is fully configured
      builtins.length config.networking.firewall.trustedInterfaces == 0
    );
  };
}