diff --git a/modules/system/access.nix b/modules/system/access.nix
index eaaba2e6..99c954ba 100644
--- a/modules/system/access.nix
+++ b/modules/system/access.nix
@@ -140,6 +140,9 @@ in {
       default = domain;
     };
     global.enable = mkEnableOption "globally routeable";
+    online.enable = mkEnableOption "a deployed machine" // {
+      default = true;
+    };
     hostnameForNetwork = mkOption {
       type = attrsOf str;
       default = {};
diff --git a/nixos/dnsmasq.nix b/nixos/dnsmasq.nix
index 088db8c3..faf64344 100644
--- a/nixos/dnsmasq.nix
+++ b/nixos/dnsmasq.nix
@@ -12,8 +12,8 @@
   inherit (lib.trivial) mapNullable;
   cfg = config.services.dnsmasq;
   inherit (inputs.self.lib) systems;
-  reisenSystems = filterAttrs (_: system:
-    system.config.proxmox.enabled && system.config.proxmox.node.name == "reisen"
+  localSystems = filterAttrs (_: system:
+    system.config.access.online.enable && system.config.network.local.enable or false
   ) systems;
   mkHostRecordPairs = _: system: [
     (mkHostRecordPair "int" system)
@@ -70,7 +70,7 @@ in {
       resolveLocalQueries = mkForce false;
       settings = {
         host-record = mapAttrsToList mkHostRecord systemHosts;
-        dynamic-host = mapAttrsToList mkDynamicHostRecord reisenSystems;
+        dynamic-host = mapAttrsToList mkDynamicHostRecord localSystems;
         server =
           if config.networking.nameservers' != [ ] then map (ns: ns.address) (filter filterns' config.networking.nameservers')
           else filter filterns config.networking.nameservers
diff --git a/systems/ct/default.nix b/systems/ct/default.nix
index a9f80db6..e767f09c 100644
--- a/systems/ct/default.nix
+++ b/systems/ct/default.nix
@@ -4,6 +4,7 @@ _: {
   modules = [
     ./nixos.nix
   ];
+  access.online.enable = false;
   network.networks = {
     local = {
       fqdn = null;
diff --git a/systems/tewi/default.nix b/systems/tewi/default.nix
index 78badeb0..4ccf6168 100644
--- a/systems/tewi/default.nix
+++ b/systems/tewi/default.nix
@@ -5,6 +5,7 @@ _: {
   modules = [
     ./nixos.nix
   ];
+  access.online.enable = false;
   network.networks = {
     local = {
       address4 = null;