{
  config,
  lib,
  pkgs,
  ...
}:
let
  inherit (lib)
    mkEnableOption
    mkIf
    mkOption
    types
    recursiveUpdate
    ;

  cfg = config.networking.wireless.iwd-ext;
  ini = pkgs.formats.ini { };
  defaults = {
    # without UseDefaultInterface, sometimes wlan0 simply goes AWOL with
    # NetworkManager
    # https://iwd.wiki.kernel.org/interface_lifecycle#interface_management_in_iwd
    General.UseDefaultInterface =
      with config.networking.networkmanager;
      (enable && (wifi.backend == "iwd"));
  };
  configFile = ini.generate "main.conf" (recursiveUpdate defaults cfg.settings);

in
{
  options.networking.wireless.iwd-ext = {
    enable = mkEnableOption (lib.mdDoc "iwd");

    package = mkOption {
      type = types.package;
      default = pkgs.iwd;
      defaultText = lib.literalExpression "pkgs.iwd";
      description = lib.mdDoc ''
        The iwd package to use
      '';
    };

    settings = mkOption {
      type = ini.type;
      default = { };

      example = {
        Settings.AutoConnect = true;

        Network = {
          EnableIPv6 = true;
          RoutePriorityOffset = 300;
        };
      };

      description = lib.mdDoc ''
        Options passed to iwd.
        See [here](https://iwd.wiki.kernel.org/networkconfigurationsettings) for
        supported options.
      '';
    };

    networks = mkOption {
      type = types.attrsOf ini.type;
      default = { };
      example = {
        HomeNetwork = {
          Security.PreSharedKey = "totallysecurepsk";
        };
        "@NETWORK_2_SSID@" = {
          Security.PreSharedKey = "@NETWORK_2_PSK@";
        };
      };

      description = lib.mdDoc ''
        AttrSet of type SSID - iwd network INI config.
        See [here](https://iwd.wiki.kernel.org/networkconfigurationsettings) for
        supported options.
      '';
    };
  }; # end of options.networking.wireless.iwd-ext

  config = mkIf cfg.enable {
    assertions = [
      {
        assertion = !config.networking.wireless.enable;
        message = ''
          Only one wireless daemon is allowed at the time:
          networking.wireless.enable and networking.wireless.iwd-ext.enable are
          mutually exclusive.
        '';
      }
      {
        assertion = !config.networking.iwd.enable;
        message = ''
          Only one wireless daemon is allowed at the time:
          networking.wireless.iwd.enable and networking.wireless.iwd-ext.enable are
          mutually exclusive.
        '';
      }
    ];

    environment.etc."iwd/${configFile.name}".source = configFile;

    environment.systemPackages = [ cfg.package ]; # for iwctl
    services.dbus.packages = [ cfg.package ];
    systemd.packages = [ cfg.package ];

    systemd.network.links."80-iwd" = {
      matchConfig.Type = "wlan";
      linkConfig.NamePolicy = "keep kernel";
    };

    systemd.services.iwd = {
      wantedBy = [ "multi-user.target" ];
      restartTriggers = [ configFile ];
    };
  };
}