{ config, ... }:
let
  secrets = config.sops.secrets;
  # NOTE: port is the same on every host
  wgPort = 51820;
in
{
  sops = {
    age.keyFile = "/var/lib/sops-nix/key.txt";
    secrets = {
      "wg-priv-key" = {
        sopsFile = ../../secrets/wg-nyaan-private.txt;
        owner = "systemd-network";
        group = "systemd-network";
        mode = "0640";
        format = "binary";
      };
      "wireless.env" = {
        sopsFile = ../../secrets/wireless.env;
        owner = "wpa_supplicant";
        group = "wpa_supplicant";
        format = "dotenv";
      };
    };
  };

  networking = {
    hostName = "nyaan";
    firewall.allowedUDPPorts = [ wgPort ];
    useNetworkd = true;
    wireless = {
      enable = true;
      secretsFile = secrets."wireless.env".path;
      userControlled = true;
      networks = {
        "KopsiNet-5".pskRaw = "ext:kopsinet_psk";
        "Pixel_3139" = {
          pskRaw = "ext:phone_hotspot_psk";
          hidden = true;
        };
        "eduroam" = {
          authProtocols = [ "WPA-EAP" ];
          auth = ''
            pairwise=CCMP TKIP
            eap=TTLS PEAP TLS
            group=CCMP TKIP
            identity="mbastaja@tvz.hr"
            altsubject_match="DNS:freeradius.tvz.hr"
            phase1="peaplabel=0"
            phase2="auth=PAP"
            password="ext:eduroam_pass"
            anonymous_identity="anonymous@tvz.hr"
          '';
        };
        "Students-TVZ" = {
          authProtocols = [ "WPA-EAP" ];
          auth = ''
            pairwise=CCMP TKIP
            eap=PEAP
            group=CCMP TKIP
            identity="mbastaja@tvz.hr"
            phase1="peaplabel=0"
            phase2="auth=MSCHAPV2"
            password="ext:eduroam_pass"
          '';
        };
      };
    };
    extraHosts = ''
      192.168.23.1 sagittarius sagittarius.local
      2301:db8:acad:a::1 sagittarius sagittarius.local
    '';
  };

  systemd.network = {
    enable = true;
    networks."50-wg" = {
      matchConfig.Name = "wg0";
      address = [
        "2301:db8:acad:a::2/128"
        "192.168.23.2/32"
      ];
    };
    netdevs."50-wg" = {
      netdevConfig = {
        Kind = "wireguard";
        Name = "wg0";
      };

      wireguardConfig = {
        ListenPort = wgPort;
        PrivateKeyFile = config.sops.secrets."wg-priv-key".path;
        # To automatically create routes for everything in AllowedIPs,
        # add RouteTable=main
        RouteTable = "main";
        # FirewallMark marks all packets send and received by wg0 with the
        # number 42, which can be used to define policy rules on these packets.
        FirewallMark = 42;
      };

      wireguardPeers = [
        {
          # sagittarius
          PublicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI=";
          AllowedIPs = [
            "2301:db8:acad:a::1/128"
            "192.168.23.1/32"
          ];
          Endpoint = "95.216.136.85:${toString wgPort}";
          PersistentKeepalive = 1;
        }
      ];
    };
  };
}