{
  # Docker loads br_netfilter on jeeves. Disable bridge netfilter so
  # br-nix-builder behaves like a pure L2 bridge and bridged traffic
  # does not hit the host firewall/rpfilter path.
  boot.kernel.sysctl = {
    "net.bridge.bridge-nf-call-arptables" = 0;
    "net.bridge.bridge-nf-call-ip6tables" = 0;
    "net.bridge.bridge-nf-call-iptables" = 0;
  };

  networking = {
    hostName = "jeeves";
    hostId = "0e15ce35";
    firewall = {
      enable = true;
      interfaces.br-nix-builder = {
        allowedTCPPorts = [ ];
        allowedUDPPorts = [ ];
      };
      allowedTCPPorts = [
        8070
      ];
    };
    useNetworkd = true;
    # Without this, unconfigured NICs get a catch-all DHCP network and
    # join the LAN uninvited (how the dead atlantic card ended up
    # ARP-poisoning 192.168.99.14). Every interface must be configured
    # explicitly below.
    useDHCP = false;
  };

  systemd.network = {
    enable = true;
    wait-online = {
      enable = false;
      anyInterface = true;
    };
    netdevs = {
      "20-br-nix-builder" = {
        netdevConfig = {
          Kind = "bridge";
          Name = "br-nix-builder";
        };
      };
      "30-internet-vlan" = {
        netdevConfig = {
          Kind = "vlan";
          Name = "internet-vlan";
        };
        vlanConfig.Id = 100;
      };
    };
    networks = {
      # Unused second port of the onboard i350; keep it down so the dead
      # PCIe link (see dmesg "PCIe link lost") stops logging Tx errors.
      "01-unused-igb-port" = {
        matchConfig.Name = "enp97s0f0";
        linkConfig.ActivationPolicy = "always-down";
      };
      # Aquantia 10G card (0000:21:00.0); loses PCIe link, and its
      # unicast RX path is dead while TX still works, so when it's up it
      # answers ARP for the host IPs and black-holes the replies. Keep
      # it down until the card is fixed or replaced.
      "01-unused-atlantic-port" = {
        matchConfig.Name = "enp33s0";
        linkConfig.ActivationPolicy = "always-down";
      };
      "10-Primary" = {
        matchConfig.Name = "enp97s0f1";
        address = [ "192.168.99.14/24" ];
        dns = [
          "192.168.99.1"
          "2600:4040:abfb:d700::1"
        ];
        routes = [ { Gateway = "192.168.99.1"; } ];
        vlan = [ "internet-vlan" ];
        dhcpV4Config.UseDNS = false;
        dhcpV6Config.UseDNS = false;
        ipv6AcceptRAConfig.UseDNS = false;
        linkConfig.RequiredForOnline = "routable";
      };
      "50-internet-vlan" = {
        matchConfig.Name = "internet-vlan";
        bridge = [ "br-nix-builder" ];
        linkConfig.RequiredForOnline = "no";
      };
      "60-br-nix-builder" = {
        matchConfig.Name = "br-nix-builder";
        bridgeConfig = { };
        networkConfig = {
          IPv6AcceptRA = false;
          LinkLocalAddressing = "no";
        };
        linkConfig.RequiredForOnline = "no";
      };
    };
  };
}