{
  config,
  lib,
  ...
}:
{
  networking.domain = "home.arpa";

  services.openssh.openFirewall = lib.mkDefault (
    # default to open for new machines until firewall is fully configured
    builtins.length config.networking.firewall.trustedInterfaces == 0
  );
}