{ outputs, ... }:
{
  networking.firewall = {
    allowPing = false;
    extraInputRules = ''
      ip saddr { ${outputs.ips.server}, ${outputs.ips.wgSpan}.1 } accept comment "Accept Server"
    '';
  };
}