{
  config,
  lib,
  pkgs,
  ...
}:
let
  port = 51820;
  interface = config.my.interfaces.${config.networking.hostName};
in
{
  options.my.services.wireguard.enable = lib.mkEnableOption "WireGuard VPN configuration";
  config = lib.mkIf (config.my.services.wireguard.enable && config.my.secureHost) {
    sops.secrets."server/private".sopsFile = ../../secrets/wireguard.yaml;
    networking = {
      firewall.allowedUDPPorts = [ port ];
      nat = {
        enable = true;
        externalInterface = interface;
        internalInterfaces = [ "wg0" ];
      };
      wireguard.interfaces.wg0 = {
        ips = [ "10.100.0.1/24" ];
        listenPort = port;
        postSetup = "${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ${interface} -j MASQUERADE";
        postShutdown = "${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o ${interface} -j MASQUERADE";
        privateKeyFile = config.sops.secrets."server/private".path;
        peers = [
          {
            publicKey = "ciupBjCcIpd3K5vlzNMJC8iiyNqB9xXwkSC6UXPKP3g=";
            allowedIPs = [ "10.100.0.2/32" ];
          } # phone
          {
            publicKey = "JgeA1ElDwR7oLmyGn8RzvxiscMBhR8+L+mEjY1Cq7gk=";
            allowedIPs = [ "10.100.0.3/32" ];
          } # tablet
          {
            publicKey = "giPVRUTLtqPGb57R4foGZMNS0tjIp2ry6lMKYtqHjn4=";
            allowedIPs = [ "10.100.0.15/32" ];
          } # jeancarlos
          {
            publicKey = "92JdW/NExg1tUE4cEyl6Yn+0Eex+iFVA37ahPRhRnRM=";
            allowedIPs = [ "10.100.0.16/32" ];
          } # gorilia
        ];
      };
    };
  };
}