_: {
  networking = {
    dhcpcd.extraConfig = "nohook resolv.conf";
    nameservers = [
      "103.1.206.179"
      "168.138.8.38"
      "168.138.12.137"
    ];
  };
  networking.networkmanager = {
    enable = true;
    # this should be moved to desktop profile ig
    ensureProfiles.profiles."Wired connection 1" = {
      connection = {
        type = "802-3-ethernet";
        id = "home lan";
        interface-name = "enp3s0";
      };
      ipv4 = {
        method = "auto";
        ignore-auto-dns = true;
      };
      ipv6 = {
        method = "auto";
        ignore-auto-dns = true;
      };
    };
  };

  # services.unbound = {
  #   enable = true;
  #   settings = {
  #     server = {
  #       interface = [
  #         "127.0.0.1"
  #         "::0"
  #       ];
  #       access-control = [ "127.0.0.1 allow" ];
  #       harden-glue = true;
  #       harden-dnssec-stripped = true;
  #       use-caps-for-id = false;
  #       prefetch = true;
  #       hide-identity = true;
  #       hide-version = true;
  #     };
  #     forward-zone = [
  #       {
  #         name = ".";
  #         forward-addr = [
  #           "103.1.206.179"
  #           "168.138.8.38"
  #           "168.138.12.137"
  #         ];
  #         forward-tls-upstream = true;
  #       }
  #     ];
  #   };
  # };

  services.mullvad-vpn.enable = true;
  services.tailscale = {
    enable = true;
    useRoutingFeatures = "client";
  };
}