{
  # list of enabled services on the system
  services = {
    tuned.enable = true;
    upower.enable = true;
    fwupd.enable = true;
    tailscale = {
      enable = true;
      # inbound 41641/udp so peers can connect directly instead of via DERP
      openFirewall = true;
    };
  };
}