{ config, ... }:
let
  # NOTE: port is the same on every host
  port = 51820;
in
{
  networking.firewall.allowedUDPPorts = [ port ];
  networking.useNetworkd = true;

  systemd.network = {
    enable = true;
    networks."50-wg" = {
      matchConfig.Name = "wg0";
      address = [
        "2301:db8:acad:a::1/128"
        "192.168.23.1/32"
      ];
    };
    netdevs."50-wg" = {
      netdevConfig = {
        Kind = "wireguard";
        Name = "wg0";
      };

      wireguardConfig = {
        ListenPort = port;
        PrivateKeyFile = config.sops.secrets."wg-priv-key".path;
        # To automatically create routes for everything in AllowedIPs,
        # add RouteTable=main
        RouteTable = "main";
        # FirewallMark marks all packets send and received by wg0 with the
        # number 42, which can be used to define policy rules on these packets.
        FirewallMark = 42;
      };

      wireguardPeers = [
        {
          # nyaan
          PublicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0=";
          AllowedIPs = [
            "2301:db8:acad:a::2/128"
            "192.168.23.2/32"
          ];
        }
      ];
    };
  };
}