{
  # i am shameless, i know -e
  aspartame.modules = [
    {
      services.headscale = {
        enable = true;
        port = 6562;
        settings = {
          server_url = "https://vpn.collective-conciousness.monster";
          dns.magic_dns = false;

          log.level = "warn";
          logtail.enables = false;
          metrics_listen_addr = "127.0.0.1:6563";

          ip_prefixes = [
            "100.81.0.0/10"
            "fd7a:115c:a1e0::/48"
          ];

          derp.server = {
            enable = true;
            region_id = 999;
            stun_listen_addr = "0.0.0.0:6561";
          };
        };
      };
      networking.firewall.allowedUDPPorts = [ 6561 ];
    }
  ];

  universal.modules = [
    {
      services.tailscale = {
        enable = true;
        openFirewall = true;
        useRoutingFeatures = "both";
      };
    }
  ];

  /*
    sucrose.modules = [
      {
        services.tailscale.extraSetFlags = [
          "--advertise-exit-node"
        ];
      }
    ];
  */
  # this is not needed, currently -e
}