{
  roles.tailscale = {
    enable = true;
    enableSSH = true;
  };

  roles.prometheus.exporters = {
    enable = true;
    openFirewall = true;
    node = {
      enable = true;
      extraFlags = [
        "--collector.disable-defaults"
        "--collector.filesystem"
        "--collector.stat"
        "--collector.time"
      ];
    };
    systemd.enable = true;
  };

  roles.cadvisor = {
    enable = true;
    openFirewall = true;
  };
}