{ pkgs, lib, config, hostName, private, ... }:
let
  domain = "sourcephile.fr";
  iface = "wg-intra";
  wg = config.networking.wireguard.interfaces.${iface};
  peer = {
    publicKey = "tE4fzqDrr7BgfOo9tWgGnpu3v0JRDEUZbJnm9e2F/GA=";
    allowedIPs = [ "192.168.42.4/32" ];
  };
  peers = {
    mermet = {
      publicKey = "XbTEP2X71LBTjmdmySdiOpQJ+uIomcXvg1aiQGUtWBI=";
      endpoint = "mermet.${domain}:43642";
      endpointsUpdater.enable = true;
      allowedIPs = [ "192.168.42.1/32" ];
      persistentKeepalive = 25;
      dynamicEndpointRefreshSeconds = 30 * 60;
    };
    losurdo = {
      publicKey = "xsFFep3k8z0pXgUOz4aryOF8l/KPBSOd4WQA26BkXy0=";
      #endpoint = "losurdo.${domain}:43642";
      allowedIPs = [ "192.168.42.2/32" ];
      persistentKeepalive = 5;
    };
  };
  keyToUnitName = lib.replaceChars
    [ "/" "-" " " "+" "=" ]
    [ "-" "\\x2d" "\\x20" "\\x2b" "\\x3d" ];
in
{
networking.firewall.extraCommands = ''
  ip46tables -A nixos-fw -i ${iface} -p tcp -m tcp --dport 22 -j ACCEPT
  ip46tables -A nixos-fw -i any -p udp -m udp --dport ${toString wg.listenPort} -j ACCEPT
'';
networking.wireguard.interfaces.${iface} = {
  ips = peer.allowedIPs;
  # Different from losurdo's listenPort to have them work behind the same NAT.
  listenPort = 43644;
  privateKeyFile = "${private}/${hostName}/wireguard/${iface}/privateKey";
  peers = lib.attrValues peers;
};
networking.hosts = builtins.listToAttrs (lib.concatLists (lib.attrValues (lib.mapAttrs (peerName: peer:
  map (ip: lib.nameValuePair (lib.removeSuffix "/32" ip) ["${peerName}.wg"]) peer.allowedIPs
  ) peers)));
/*
systemd.services =
  {
    openssh = {
      after = ["wireguard-${iface}.service"];
      serviceConfig.Restart = "on-failure";
    };
  };
services.openssh.listenAddresses = map (ip: {addr=lib.removeSuffix "/32" ip;}) peer.allowedIPs;
*/
}