{
  lib,
  xlib,
  ...
}:
{
  services.tailscale.enable = xlib.device.type != "wsl"; # true, if not wsl

  # All real hosts (not the bare "minimal" test config) get OOM protection
  # and a bounded journal.
  services = {
    earlyoom.enable = lib.mkIf (xlib.device.type != "minimal") true;
    journald.settings.Journal = lib.mkIf (xlib.device.type != "minimal") {
      SystemMaxUse = "512M";
    };
  };
}