{ config, flakeRoot, ... }:
let
  secrets = config.sops.secrets;
in
{
  imports = [ (flakeRoot + /wireguard.nix) ];

  sops = {
    age.keyFile = "/var/lib/sops-nix/key.txt";
    secrets."wireless.env" = {
      sopsFile = ../../secrets/wireless.env;
      owner = "wpa_supplicant";
      group = "wpa_supplicant";
      format = "dotenv";
    };
  };

  networking = {
    hostName = "nyaan";
    useNetworkd = true;
    wireless = {
      enable = true;
      secretsFile = secrets."wireless.env".path;
      userControlled = true;
      networks = {
        "KopsiNet-5".pskRaw = "ext:kopsinet_psk";
        "Pixel_3139" = {
          pskRaw = "ext:phone_hotspot_psk";
          hidden = true;
        };
        "eduroam" = {
          authProtocols = [ "WPA-EAP" ];
          auth = ''
            pairwise=CCMP TKIP
            eap=TTLS PEAP TLS
            group=CCMP TKIP
            identity="mbastaja@tvz.hr"
            altsubject_match="DNS:freeradius.tvz.hr"
            phase1="peaplabel=0"
            phase2="auth=PAP"
            password="ext:eduroam_pass"
            anonymous_identity="anonymous@tvz.hr"
          '';
        };
        "Students-TVZ" = {
          authProtocols = [ "WPA-EAP" ];
          auth = ''
            pairwise=CCMP TKIP
            eap=PEAP
            group=CCMP TKIP
            identity="mbastaja@tvz.hr"
            phase1="peaplabel=0"
            phase2="auth=MSCHAPV2"
            password="ext:eduroam_pass"
          '';
        };
      };
    };
  };
}