diff --git a/.gitignore b/.gitignore
index 3cb44c3..c4b78ea 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,4 @@ result-*
 # Ignore automatically generated direnv output
 .direnv
 
+!.jj/
diff --git a/modules/networking/core/default.nix b/modules/networking/core/default.nix
index e65f50d..9f9fac0 100644
--- a/modules/networking/core/default.nix
+++ b/modules/networking/core/default.nix
@@ -1,38 +1,38 @@
-{ ... }:
-
+{ config, lib, ... }:
+let
+  cfg = config.homelab.networking.core;
+in
 {
-  imports = [
-    ./firewall.nix
-  ];
-
-  networking = {
-    networkmanager = {
-      enable = true;
-      dns = "systemd-resolved";
-    };
-    extraHosts = "192.168.1.60 laptop";
-    nftables.enable = true;
-
-    nameservers = [
-      "192.168.1.193" # Pi-hole
-      "1.1.1.1" # Cloudflare
-      "1.0.0.1" # Cloudflare (Secondary)
+  config = {
+    imports = [
+      ./firewall.nix
     ];
-  };
 
-  services.resolved = {
-    enable = true;
+    networking = {
+      networkmanager = {
+        enable = true;
+        dns = "systemd-resolved";
+      };
 
-    settings.Resolve = {
-      dnssec = "true";
-      DNSOverTLS = "true";
-      domains = [ "~." ];
-      fallbackDns = [
-        "192.168.1.193" # Pi-hole
-        "1.1.1.1" # Cloudflare
-        "1.0.0.1" # Cloudflare (Secondary)
-      ];
+      networking.extraHosts = lib.concatMapStringsSep "\n" (
+        host: "${host.ip_address} ${host.hostname}"
+      ) cfg.extraHosts;
+
+      nftables.enable = true;
+
+      nameservers = config.core.nameservers;
     };
 
+    services.resolved = {
+      enable = true;
+
+      settings.Resolve = {
+        dnssec = "true";
+        DNSOverTLS = "true";
+        domains = [ "~." ];
+        fallbackDns = cfg.nameservers;
+      };
+
+    };
   };
 }
diff --git a/modules/networking/core/firewall.nix b/modules/networking/core/firewall.nix
index 88c1f69..a29d1e1 100644
--- a/modules/networking/core/firewall.nix
+++ b/modules/networking/core/firewall.nix
@@ -1,17 +1,14 @@
-{ ... }:
-
+{ config, ... }:
+let
+  cfg = config.homelab.networking.core.firewall;
+in
 {
   networking.firewall = {
     enable = true;
 
-    allowPing = true;
+    allowPing = cfg.allowPing;
 
-    allowedTCPPorts = [
-      22
-      80
-    ];
-    allowedUDPPorts = [
-      53
-    ];
+    allowedTCPPorts = cfg.ports.tcp;
+    allowedUDPPorts = cfg.ports.udp;
   };
 }
diff --git a/modules/networking/options.nix b/modules/networking/options.nix
index e9249b1..2835c86 100644
--- a/modules/networking/options.nix
+++ b/modules/networking/options.nix
@@ -1,18 +1,71 @@
 {
-  config,
   lib,
-  pkgs,
   ...
 }:
-let
-  cfg = config.homelab.networking;
-in
 {
   options.homelab.networking = {
-    enable = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = "Enable homelab networking support.";
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "river";
+      description = "The user to run tailscale's services as.";
+    };
+
+    # core
+    core = {
+      firewall = {
+        allowPing = lib.mkEnableOption "Enable ICMP Pinging" {
+          enable = true;
+          default = true;
+        };
+
+        ports = {
+          tcp = lib.mkOption {
+            type = with lib.types; listOf number;
+            default = [
+              22
+              80
+            ];
+          };
+          udp = lib.mkOption {
+            type = with lib.types; listOf number;
+            default = [ 53 ];
+          };
+        };
+      };
+
+      extraHosts = lib.mkOption {
+        type =
+          with lib.types;
+          listOf (
+            submodule (
+              { ... }: {
+                options = {
+                  ip_address = lib.mkOption {
+                    type = str;
+                  };
+
+                  hostname = lib.mkOption {
+                    type = str;
+                  };
+                };
+              }
+            )
+          );
+
+        default = [ ];
+        description = "Additional hosts to add.";
+      };
+
+      nameservers = lib.mkOption {
+        type = with lib.types; listOf str;
+
+        default = [
+          "192.168.1.193"
+          "1.1.1.1"
+          "1.0.0.1"
+        ];
+        description = "DNS Resolvers for System";
+      };
     };
 
     # wireguard
@@ -61,5 +114,13 @@ in
         );
       };
     };
+
+    # tailscale
+    tailscale = {
+      enable = lib.mkEnableOption "Enable Tailscale Mesh VPN" {
+        enable = true;
+        default = false;
+      };
+    };
   };
 }
diff --git a/modules/networking/tailscale.nix b/modules/networking/tailscale.nix
index 57a3e57..f216587 100644
--- a/modules/networking/tailscale.nix
+++ b/modules/networking/tailscale.nix
@@ -1,25 +1,29 @@
-{ config, ... }:
-
+{ config, lib, ... }:
+let
+  cfg = config.homelab.networking.tailscale;
+in
 {
-  services.tailscale = {
-    enable = true;
-    openFirewall = true;
-    extraSetFlags = [ "--operator=river" ];
+  config = lib.mkIf cfg.enable {
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+      extraSetFlags = [ "--operator=${cfg.user}" ];
+    };
+
+    networking.firewall = {
+      trustedInterfaces = [ config.services.tailscale.interfaceName ];
+      allowedUDPPorts = [ config.services.tailscale.port ];
+    };
+
+    systemd.services.tailscaled.serviceConfig.Environment = [
+      "TS_DEBUG_FIREWALL_MODE=nftables"
+    ];
+
+    systemd.network.wait-online.enable = false;
+    boot.initrd.systemd.network.wait-online.enable = false;
+
+    users.users.${cfg.user}.extraGroups = [
+      "tailscale"
+    ];
   };
-
-  networking.firewall = {
-    trustedInterfaces = [ config.services.tailscale.interfaceName ];
-    allowedUDPPorts = [ config.services.tailscale.port ];
-  };
-
-  systemd.services.tailscaled.serviceConfig.Environment = [
-    "TS_DEBUG_FIREWALL_MODE=nftables"
-  ];
-
-  systemd.network.wait-online.enable = false;
-  boot.initrd.systemd.network.wait-online.enable = false;
-
-  users.users.river.extraGroups = [
-    "tailscale"
-  ];
 }
diff --git a/modules/networking/wireguard.nix b/modules/networking/wireguard.nix
index 70f233a..2eee5a5 100644
--- a/modules/networking/wireguard.nix
+++ b/modules/networking/wireguard.nix
@@ -1,22 +1,21 @@
-{ ... }:
-
+{ config, lib, ... }:
+let
+  cfg = config.homelab.networking.wireguard;
+in
 {
-  networking.wireguard.interfaces = {
-    wg0 = {
-      ips = [ "10.0.0.2/24" ];
-      privateKeyFile = "/etc/wireguard/private.key"; # Keep secrets out of the nix store!
+  config = lib.mkIf cfg.enable {
+    networking.wg-quick.interfaces = lib.mapAttrs (name: iface: {
+      address = iface.address;
+      privateKeyFile = iface.privateKeyFile;
+      peers = map (p: {
+        publicKey = p.publicKey;
+        allowedIPs = p.allowedIPs;
+        endpoint = p.endpoint;
 
-      peers = [
-        {
-          publicKey = "vUUL4CD+1Sa2U2SZYa2P9IoFC2HxEr+PYNmYfRE8wwY=";
-          allowedIPs = [ "0.0.0.0/0" ];
-          endpoint = "server.maariz.org:51820";
-          persistentKeepalive = 25;
-        }
-      ];
-    };
+        persistentKeepalive = if p.persistentKeepalive != null then p.persistentKeepalive else null;
+      }) iface.peers;
+    }) (lib.filterAttrs (_: v: v.enable) cfg.interfaces);
+
+    networking.firewall.allowedUDPPorts = [ 51820 ];
   };
-
-  # Ensure the Wireguard UDP port is open if you are hosting the server
-  networking.firewall.allowedUDPPorts = [ 51820 ];
 }