{
  config,
  ...
}:
let
  secrets = config.sops.secrets;
in
{
  sops = {
    age.keyFile = "/var/lib/sops-nix/key.txt";
    secrets."wireless.env" = {
      sopsFile = ../../secrets/wireless.env;
      format = "dotenv";
      reloadUnits = [ "iwd.service" ];
    };
  };

  networking = {
    hostName = "nyaan";
    useNetworkd = true;
    firewall = {
      checkReversePath = "loose";
      trustedInterfaces = [ "tailscale0" ];
      allowedUDPPorts = [ config.services.tailscale.port ];
    };
  };

  services.tailscale = {
    enable = true;
    openFirewall = true;
  };

  networking.wireless.iwd-ext = {
    enable = true;
    secretsEnvFile = secrets."wireless.env".path;
    networks = {
      "KopsiNet-5" = {
        networkType = "psk";
        config.Security.Passphrase = "@KOPSINET_PSK@";
      };
      "Pixel_3169" = {
        networkType = "psk";
        config.Security.Passphrase = "@PHONE_HOTSPOT_PSK@";
      };
      "eduroam" = {
        networkType = "8021x";
        config.Security = {
          EAP-Method = "TTLS";
          EAP-Identity = "anonymous@tvz.hr";
          EAP-TTLS-CACert = "embed:eduroam_ca_cert";
          EAP-TTLS-ServerDomainMask = "freeradius.tvz.hr";
          EAP-TTLS-Phase2-Method = "Tunneled-PAP";
          EAP-TTLS-Phase2-Identity = "mbastaja@tvz.hr";
          EAP-TTLS-Phase2-Password = "@EDUROAM_PASS@";
        };
        config.Settings.AutoConnect = true;
        extraConfigLines = ''
          [@@pem@@eduroam_ca_cert]
          -----BEGIN CERTIFICATE-----
          MIIDjzCCAnegAwIBAgIBADANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJIUjEP
          MA0GA1UECAwGWmFncmViMQ8wDQYDVQQHDAZaYWdyZWIxDDAKBgNVBAoMA1RWWjEj
          MCEGA1UEAwwaQ0EgUm9vdCBjZXJ0aWZpY2F0ZSB0dnouaHIwHhcNMTcwNzE0MTE1
          MzUzWhcNMjcwNzEyMTE1MzUzWjBiMQswCQYDVQQGEwJIUjEPMA0GA1UECAwGWmFn
          cmViMQ8wDQYDVQQHDAZaYWdyZWIxDDAKBgNVBAoMA1RWWjEjMCEGA1UEAwwaQ0Eg
          Um9vdCBjZXJ0aWZpY2F0ZSB0dnouaHIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
          ggEKAoIBAQC+/60HDgUIMu3F61a0iihkxoAgGJpbaz8bu9WEaKNURFXMW/9FWIPf
          xBQbYr3RFaPdpgTLKwtP8ZcCNqH4QM8bwBirk7gMjeNQfUc0DcC1xj0yCjWTLx7L
          CxWzOPI/3QZdjlltV5g1bL0nObBXJTqLpJazfJa+c5rMSjuxeHQtOts4h9cPT+3c
          Lc21IF3l0Ck4XjNrYMDuBq0B24ukkwqHkTzp5CyJk1gn4Bsr5RskUsgvbAQBacPd
          EjwjzJPlMSMpcZw87e+U22FWuhkDEMf+nKtOPxbDz0P1rdXwtsLyYww3gx/ZjzZy
          pnNJJDa+K008GJsOtRCgy1O82rOskHVxAgMBAAGjUDBOMB0GA1UdDgQWBBSJ843O
          80eWXlzlc5L2e5NSmJt8VTAfBgNVHSMEGDAWgBSJ843O80eWXlzlc5L2e5NSmJt8
          VTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQBwrBXWaKBkL3vZBtDs
          Ebez/E2vU8OSWt53l8gDgPoWVd66qh3k76IkwcW9OB3JwZpY63ZYTC/J+by4/hZh
          f5l2AWjjW5sasXz3HlNUexJomk1llLvDJt/eKuTM/5k3LzgbAhmjhzE7Jh3wZJF5
          rKOQ9fN7zJ414EebjkeGSgDosq3ip290vFiBc+heqgdfZsDdyxuIKkJCtYYYI8hP
          UcKRfJ4nr8enAVkbbjElc5qF7s2Gz0+0owI7ZV/KaXd2ZGcnh6nRx5OIcDGXNLK9
          I87CtgF5KX0AGXEMJeG/Jms9hDdn18SXwxIgG6jX7DlAUsz/PVcwDNxF3RCHvsuy
          HoU+
          -----END CERTIFICATE-----
        '';
      };
      "Students-TVZ" = {
        networkType = "8021x";
        config.Security = {
          EAP-Method = "PAP";
          EAP-Identity = "mbastaja@tvz.hr";
          EAP-PAEP-ServerDomainMasl = "freeradius.tvz.hr";
          EAP-PEAP-Phase2-Method = "MSCHAPV2";
          EAP-PEAP-Phase2-Identity = "mbastaja@tvz.hr";
          EAP-PEAP-Phase2-Password = "@EDUROAM_PASS@";
        };
      };
    };
  };
}