{
  config,
  lib,
  pkgs,
  ...
}:
let
  inherit (lib)
    mkEnableOption
    mkIf
    mkOption
    types
    recursiveUpdate
    literalExpression
    optionalAttrs
    ;

  inherit (pkgs)
    concatTextFile
    ;

  inherit (lib.strings)
    concatStringsSep
    ;

  inherit (lib.attrsets)
    mapAttrs'
    ;

  cfg = config.networking.wireless.iwd-ext;

  ini = pkgs.formats.ini {
    listToValue = l: concatStringsSep "," (map toString l);
  };

  defaults =
    with config.networking.networkmanager;
    optionalAttrs (enable && (wifi.backend == "iwd")) {
      # without DefaultInterface, sometimes wlan0 simply goes AWOL with NetworkManager
      # https://iwd.wiki.kernel.org/interface_lifecycle#interface_management_in_iwd
      DriverQuirks.DefaultInterface = "?*";
    };
  configFile = ini.generate "main.conf" (recursiveUpdate defaults cfg.settings);

  networkTemplates = mapAttrs' (
    k: v:
    let
      name = "${k}.${v.networkType}";
      generatedConfig = ini.generate "${name}" v.config;
    in
    {
      inherit name;
      value = concatTextFile {
        name = "${k}-network";
        files = [ generatedConfig ];
        destination = "/var/lib/iwd/${name}";
      };
    }
  ) cfg.networks;

  networkTemplateDir = pkgs.symlinkJoin {
    name = "iwd-network-templates";
    paths = builtins.attrValues networkTemplates;
  };

  networkSubmodule = types.submodule {
    options = {
      networkType = mkOption {
        type = types.enum [
          "open"
          "psk"
          "8021x"
        ];
        default = "psk";
        defaultText = literalExpression "psk";
        description = ''
          Network type according to security method. See iwd.network (5)
        '';
      };
      config = mkOption { type = ini.type; };
    };
  };
in
{
  options.networking.wireless.iwd-ext = {
    enable = mkEnableOption (lib.mdDoc "iwd");

    package = mkOption {
      type = types.package;
      default = pkgs.iwd;
      defaultText = lib.literalExpression "pkgs.iwd";
      description = lib.mdDoc ''
        The iwd package to use
      '';
    };

    settings = mkOption {
      type = ini.type;
      default = { };

      example = {
        Settings.AutoConnect = true;

        Network = {
          EnableIPv6 = true;
          RoutePriorityOffset = 300;
        };
      };

      description = lib.mdDoc ''
        Options passed to iwd.
        See [here](https://iwd.wiki.kernel.org/networkconfigurationsettings) for
        supported options.
      '';
    };

    networks = mkOption {
      type = types.attrsOf networkSubmodule;
      example = {
        HomeNetwork = {
          networkType = "psk";
          config.Security.Passphrase = "totallysecurepsk";
        };
        SomeOtherNetworkSSID = {
          networkType = "psk";
          config.Security.Passphrase = "@NETWORK_2_PSK@";
        };
      };

      description = lib.mdDoc ''
        AttrSet of type SSID - iwd network INI config.
        See [here](https://iwd.wiki.kernel.org/networkconfigurationsettings) for
        supported options.
      '';
    };

    secretsEnvFile = mkOption {
      type = types.path;
      example = "/run/secrets/network-secrets.env";
      description = lib.mdDoc ''
        dotenv-formatted file containing secrets that get injected into
        cfg.networks settings.
      '';
    };
  }; # end of options.networking.wireless.iwd-ext

  config = mkIf cfg.enable {
    assertions = [
      {
        assertion = !config.networking.wireless.enable;
        message = ''
          Only one wireless daemon is allowed at the time:
          networking.wireless.enable and networking.wireless.iwd-ext.enable are
          mutually exclusive.
        '';
      }
      {
        assertion = !config.networking.wireless.iwd.enable;
        message = ''
          Only one wireless daemon is allowed at the time:
          networking.wireless.iwd.enable and networking.wireless.iwd-ext.enable are
          mutually exclusive.
        '';
      }
    ];

    environment.etc."iwd/${configFile.name}".source = configFile;

    environment.systemPackages = [ cfg.package ]; # for iwctl
    services.dbus.packages = [ cfg.package ];
    systemd.packages = [ cfg.package ];

    systemd.network.links."80-iwd" = {
      matchConfig.Type = "wlan";
      linkConfig.NamePolicy = "keep kernel";
    };

    systemd.services.iwd = {
      path = [ config.networking.resolvconf.package ];
      wantedBy = [ "multi-user.target" ];
      restartTriggers = [ configFile ];
      serviceConfig.ReadWritePaths = "-/etc/resolv.conf";
    };

    systemd.services."prepopulate-iwd-netowks" = {
      enable = true;
      enableStrictShellChecks = true;
      description = "Pre-populates network configs for iwd";
      before = [ "iwd.service" ];
      wantedBy = [ "iwd.service" ];
      after = [ "sops-install-secrets.service" ];

      serviceConfig = {
        EnvironmentFile = "${cfg.secretsEnvFile}";
        StateDirectory = "iwd";
        StateDirectoryMode = 0700;
      };

      path = [ pkgs.envsubst ];
      script = ''
        set -xeu

        rm "$STATE_DIRECTORY/*.{open,psk,8021x}"

        for f in ${networkTemplateDir}/var/lib/iwd/*; do
          cat "$f" |
            sed -E 's/@([A-Za-z_][A-Za-z0-9_]*)@/$\{\1}/g' |
            envsubst > "$STATE_DIRECTORY/$(basename "$f")"
        done
      '';
    };
  };
}