{pkgs, ...}: {
  services.netbird.enable = true;

  systemd.services.netbird = {
    environment = {
      NB_DISABLE_SSH_CONFIG = "true";
    };
    path = [
      pkgs.shadow
      pkgs.util-linux
    ];
  };

  networking.firewall.checkReversePath = "loose";
}