{ pkgs, ... }:

{
  # wireguard replies may leave on another interface, so strict rpfilter drops them
  networking.firewall.checkReversePath = "loose";

  environment.systemPackages = [ pkgs.proton-vpn ];
}