{ config, ... }:
let
  # NOTE: port is the same on every host
  wgPort = 51820;
in
{
  networking = {
    hostName = "sagittarius";
    useNetworkd = true;
    firewall = {
      allowedTCPPorts = [ 22 ];
      allowedUDPPorts = [ wgPort ];
    };
  };

  systemd.network = {
    enable = true;

    networks = {
      "10-wan" = {
        matchConfig.Name = "enp1s0";
        networkConfig.DHCP = "ipv4";
        address = [ "2a01:4f9:c012:c7a7::1/64" ];
        routes = [ { Gateway = "fe80::1"; } ];
      };
      "50-wg" = {
        matchConfig.Name = "wg0";
        address = [
          "2301:db8:acad:a::1/128"
          "192.168.23.1/32"
        ];
      };
    };

    netdevs."50-wg" = {
      netdevConfig = {
        Kind = "wireguard";
        Name = "wg0";
      };

      wireguardConfig = {
        ListenPort = wgPort;
        PrivateKeyFile = config.sops.secrets."wg-priv-key".path;
        # To automatically create routes for everything in AllowedIPs,
        # add RouteTable=main
        RouteTable = "main";
        # FirewallMark marks all packets send and received by wg0 with the
        # number 42, which can be used to define policy rules on these packets.
        FirewallMark = 42;
      };

      wireguardPeers = [
        {
          # nyaan
          PublicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0=";
          AllowedIPs = [
            "2301:db8:acad:a::2/128"
            "192.168.23.2/32"
          ];
        }
      ];
    };
  };
}