{ config, pkgs, ... }:
let
  hostname = config.networking.hostName;
  conf = hosts."${hostname}";
  privateKeyPath = ./secrets/wireguard/${hostname}.txt;

  lib = pkgs.lib;
  wgPort = 51820; # Common port used on all peers
  firewallMark = 42;

  hosts = {
    sagittarius = {
      address = "2301:db8:acad:a::1/128";
      publicKey = "GrrN8j9ZlPjTU5sQD4l8RDCGAn2YYszbSIE1zuG4OiI=";
      endpoint = "95.216.136.85:${toString wgPort}";
    };
    nyaan = {
      address = "2301:db8:acad:a::2/128";
      publicKey = "u5nh+YNV84IbS7g0ncfs/V+cqEudNh500LQ7pmdS7j0=";
    };
  };

  generatePeer =
    hostname: values:
    {
      PublicKey = values.publicKey;
      AllowedIPs = [ values.address ];
    }
    // lib.optionalAttrs (builtins.hasAttr "endpoint" values) {
      Endpoint = values.endpoint;
      PersistentKeepalive = 1;
    };
  generatePeers =
    hostname:
    let
      peers = lib.attrsets.filterAttrs (k: v: k != hostname) hosts;
    in
    lib.attrsets.mapAttrsToList generatePeer peers;
in
{
  sops.secrets."wireguard-${hostname}-pk" = {
    sopsFile = privateKeyPath;
    owner = "systemd-network";
    group = "systemd-network";
    mode = "0640";
    format = "binary";
  };

  services.resolved.settings.Resolve.MulticastDNS = false;
  systemd.network = {
    enable = true;

    networks."50-wg" = {
      matchConfig.Name = "wg0";
      address = [ conf.address ];
    };

    netdevs."50-wg" = {
      netdevConfig = {
        Kind = "wireguard";
        Name = "wg0";
      };

      wireguardConfig = {
        ListenPort = wgPort;
        PrivateKeyFile = config.sops.secrets."wireguard-${hostname}-pk".path;
        # To automatically create routes for everything in AllowedIPs,
        # add RouteTable=main
        RouteTable = "main";
        # FirewallMark marks all packets send and received by wg0 with the
        # number, which can be used to define policy rules on these packets.
        FirewallMark = firewallMark;
      };

      wireguardPeers = generatePeers hostname;
    };
  };

  services.avahi = {
    enable = true;
    nssmdns6 = true;
    reflector = true;
    allowInterfaces = [ "wg0" ];
    publish = {
      enable = true;
      addresses = true;
      workstation = true;
    };
  };
}