{ config, ... }:
let
  # NOTE: port is the same on every host
  port = 51820;
in
{
  sops = {
    age.keyFile = "/var/lib/sops-nix/key.txt";
    secrets = {
      "wg-priv-key" = {
        sopsFile = ../../secrets/wg-nyaan-private.txt;
        owner = "systemd-network";
        group = "systemd-network";
        mode = "0640";
        format = "binary";
      };
    };
  };

  networking.firewall.allowedUDPPorts = [ port ];
  networking.useNetworkd = true;

  systemd.network = {
    enable = true;
    networks."50-wg" = {
      matchConfig.Name = "wg0";
      address = [
        "2301:db8:acad:a::2/128"
        "192.168.5.2/32"
      ];
    };
    netdevs."50-wg" = {
      netdevConfig = {
        Kind = "wireguard";
        Name = "wg0";
      };

      wireguardConfig = {
        ListenPort = port;
        PrivateKeyFile = config.sops.secrets."wg-priv-key".path;
        # To automatically create routes for everything in AllowedIPs,
        # add RouteTable=main
        RouteTable = "main";
        # FirewallMark marks all packets send and received by wg0 with the
        # number 42, which can be used to define policy rules on these packets.
        FirewallMark = 42;
      };

      wireguardPeers = [
        {
          # sagittarius
          PublicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0=";
          AllowedIPs = [
            "2301:db8:acad:a::1/128"
            "192.168.5.1/32"
          ];
          Endpoint = "95.216.136.85:${toString port}";
        }
      ];
    };
  };
}