{
  age.secrets.mullvad = {
    file = ../../../keys/mullvad;
    path = "/etc/wireguard/mullvad.conf";
  };

  networking.firewall.trustedInterfaces = [ "wg-selene" ];
  services.prowlarr.enable = true;
}