{
  lib,
  config,
  ...
}: let
  inherit (lib) mkIf;
in {
  config = mkIf config.network {
    # ethernet / wifi
    networking.networkmanager.enable = true;
    users.groups.networkmanager.members = [config.user];

    # firewall
    networking.firewall.enable = true;
    networking.firewall.allowedTCPPorts = [80 443];

    # dns
    services.resolved.enable = true;
    networking.networkmanager.dns = "systemd-resolved";
  };
}