{ services.tailscale.extraUpFlags = [ "--accept-dns" "false" ]; }