{ config, pkgs, ... }:
let
  hostname = config.networking.hostName;
  conf = hosts."${hostname}";
  privateKeyPath = ./secrets/wireguard/${hostname}.txt;

  lib = pkgs.lib;
  wgPort = 51820; # Common port used on all peers
  firewallMark = 42;

  # The topology is hub-and-spoke/star
  # sagittarius is the hub == 2301:db8:acad:a::1
  # it hosts authoritative DNS and spokes do keepalive with it.
  hosts = {
    sagittarius = {
      address = "2301:db8:acad:a::1/128";
      publicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI=";
      endpoint = "95.216.136.85:${toString wgPort}";
    };
    nyaan = {
      address = "2301:db8:acad:a::2/128";
      publicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0=";
    };
  };
  peers = lib.attrsets.filterAttrs (k: v: k != hostname) hosts;

  generatePeer =
    hostname: values:
    {
      PublicKey = values.publicKey;
      AllowedIPs = [ values.address ];
    }
    // lib.optionalAttrs (builtins.hasAttr "endpoint" values) {
      Endpoint = values.endpoint;
      PersistentKeepalive = 1;
    };
  generatedPeers = lib.attrsets.mapAttrsToList generatePeer peers;

  # stripNetmask = addr: lib.strings.removeSuffix "/128" addr;
  # generatedHosts = lib.attrsets.mapAttrs' (hostname: value: {
  #   name = stripNetmask value.address;
  #   value = [
  #     hostname
  #     "${hostname}.internal"
  #   ];
  # }) peers;
in
{
  sops.secrets."wireguard-${hostname}-pk" = {
    sopsFile = privateKeyPath;
    owner = "systemd-network";
    group = "systemd-network";
    mode = "0640";
    format = "binary";
  };

  networking.nameservers = [
    "2301:db8:acad:a::1" # see the zonefile in etc/dns
  ];

  systemd.network = {
    enable = true;

    networks."50-wg" = {
      matchConfig.Name = "wg0";
      address = [ conf.address ];
    };

    netdevs."50-wg" = {
      netdevConfig = {
        Kind = "wireguard";
        Name = "wg0";
      };

      wireguardConfig = {
        ListenPort = wgPort;
        PrivateKeyFile = config.sops.secrets."wireguard-${hostname}-pk".path;
        # To automatically create routes for everything in AllowedIPs,
        # add RouteTable=main
        RouteTable = "main";
        # FirewallMark marks all packets send and received by wg0 with the
        # number, which can be used to define policy rules on these packets.
        FirewallMark = firewallMark;
      };

      wireguardPeers = generatedPeers;
    };
  };
}