{
  config,
  pkgs,
  flakeRoot,
  ...
}:
let
  lib = pkgs.lib;
  secrets = config.sops.secrets;

  networks = {
    "KopsiNet-5" = {
      type = "psk";
      Security.Passphrase = "@KOPSINET_PSK@";
    };
    "Pixel_3139" = {
      type = "psk";
      Security.Passphrase = "@PHONE_HOTSPOT_PSK@";
    };
    "eduroam" = {
      type = "8021x";
      Security = {
        EAP-Method = [
          "TTLS"
          "PEAP"
          "TLS"
        ];
        EAP-Identity = "mbastaja@tvz.hr";
        EAP-AnonymousIdentity = "anonymous@tvz.hr";
        DomainSuffixMatch = "freeradius.tvz.hr";
        EAP-TTLS-Phase2-Method = "Tunneled-PAP";
      };
    };
    "Students-TVZ" = {
      type = "8021x";
      Secuirty = {
        EAP-Method = "PAP";
        EAP-Identity = "mbastaja@tvz.hr";
        EAP-PEAP-Phase2-Method = "MSCHAPV2";
        EAP-Password = "@EDUROAM_PASS@";
      };
    };
  };

  generators = lib.generators;
  networkINIGenerator = generators.toINI {
    mkKeyValue = generators.mkKeyValueDefault {
      mkValueString =
        v:
        if v == true then
          "true"
        else if v == false then
          "false"
        else if builtins.isList v then
          pkgs.lib.strings.concatStringsSep "," v
        else if builtins.isString v then
          "${v}"
        else
          generators.mkValueStringDefault { } v;
    } "=";
  };

  networkTemplates = lib.attrsets.mapAttrs' (
    k: v:
    let
      textContents = networkINIGenerator (builtins.removeAttrs v [ "type" ]);
      name = "${k}.${v.type}";
    in
    {
      inherit name;
      value = pkgs.writeTextDir "share/${name}" textContents;
    }
  ) networks;

  networkTemplateDir = pkgs.symlinkJoin {
    name = "iwd-network-templates";
    paths = builtins.attrValues networkTemplates;
  };
in
{
  imports = [ (flakeRoot + /wireguard.nix) ];

  sops = {
    age.keyFile = "/var/lib/sops-nix/key.txt";
    secrets."wireless.env" = {
      sopsFile = ../../secrets/wireless.env;
      format = "dotenv";
    };
  };

  networking = {
    hostName = "nyaan";
    useNetworkd = true;
    firewall.enable = false;
    nftables = {
      enable = true;
      tables.filter = {
        enable = true;
        family = "inet";
        content = ''
          	set temp-ports {
              type inet_proto . inet_service
              flags interval
              comment "Temporarily opened ports"
            }

          	chain rpfilter {
              type filter hook prerouting priority mangle + 10; policy drop;
              meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
              fib saddr . mark . iif check exists accept
              jump rpfilter-allow
            }

            chain rpfilter-allow {
            }

            chain prerouting {
              type filter hook prerouting priority mangle;
              iifname "wg0" meta mark set 42
            }

            chain input {
              type filter hook input priority filter; policy drop;
              iifname "lo" accept comment "trusted interfaces"
              icmpv6 type echo-reply accept
              ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow }
            }

            chain input-allow {
              # tcp dport { 22, 80, 443 } accept
              udp dport 51820 accept
              meta l4proto . th dport @temp-ports accept
              icmp type echo-request accept comment "allow ping"
              icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139).  See RFC 4890, section 4.4."
              ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"
            }
        '';
      };
    };
  };

  networking.wireless.iwd.enable = true;
  systemd.services."prepopulate-iwd-netowks" = {
    enable = true;
    enableStrictShellChecks = true;
    description = "Pre-populates network configs for iwd";
    before = [ "iwd.service" ];
    wantedBy = [ "iwd.service" ];

    serviceConfig = {
      EnvironmentFile = "${secrets."wireless.env".path}";
    };

    path = [ pkgs.envsubst ];
    script = ''
      rm -r /var/lib/iwd
      mkdir -p /var/lib/iwd

      for f in ${networkTemplateDir}/share/*; do
        cat "$f" |
          sed -E 's/@([A-Za-z_][A-Za-z0-9_]*)@/$\{\1}/g' |
          envsubst > "/var/lib/iwd/$(basename "$f")"
      done
    '';
  };
}