{ pkgs, config, ... }: {

    networking.wireguard.enable = true;

    # Open ports in the firewall.
    # networking.firewall.allowedTCPPorts = [ ... ];
    # networking.firewall.allowedUDPPorts = [ ... ];
    networking.firewall.allowedUDPPorts = [
        51820 # wireguard client
    ];

    boot.kernelModules = [
        "wireguard"
  ];
}