config/packages/nixpak/modules/network.nix

{
  etc.sslCertificates.enable = true;
  bubblewrap = {
    bind.ro = [ "/etc/resolv.conf" ];
    network = true;
  };
}