{ flakeRoot, ... }:
{
  imports = [ (flakeRoot + /wireguard.nix) ];

  networking = {
    hostName = "sagittarius";
    useNetworkd = true;
    firewall.enable = false;
    nftables = {
      enable = true;
      tables.filter = {
        enable = true;
        family = "inet";
        content = ''
          	set temp-ports {
              type inet_proto . inet_service
              flags interval
              comment "Temporarily opened ports"
            }

          	chain rpfilter {
              type filter hook prerouting priority mangle + 10; policy drop;
              meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
              fib saddr . mark . iif check exists accept
              jump rpfilter-allow
            }

            chain rpfilter-allow {
            }

            chain prerouting {
              type filter hook prerouting priority mangle;
              iifname "wg0" meta mark set 42
            }

            chain input {
              type filter hook input priority filter; policy drop;
              iifname "lo" accept comment "trusted interfaces"
              icmpv6 type echo-reply accept
              ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow }
            }

            chain input-allow {
              tcp dport { 22, 80, 443 } accept
              udp dport 51820 accept
              meta l4proto . th dport @temp-ports accept
              icmp type echo-request accept comment "allow ping"
              icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139).  See RFC 4890, section 4.4."
              ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"
            }
        '';
      };
    };
  };

  systemd.network = {
    enable = true;

    networks = {
      "10-wan" = {
        matchConfig.Name = "enp1s0";
        networkConfig.DHCP = "ipv4";
        address = [ "2a01:4f9:c012:c7a7::1/64" ];
        routes = [ { Gateway = "fe80::1"; } ];
      };
    };
  };
}