{ config, pkgs, lib, hostName, ... }:
let
  wg-intra-peers = import wireguard/wg-intra/peers.nix;
in
{
imports = [
  networking/nftables.nix
];
networking = {
  hostName = hostName;
  domain = lib.mkDefault "localdomain";
  #search = [ "sourcephile.fr" ];
  firewall = {
    enable = lib.mkDefault true;
    allowPing = lib.mkDefault true;
  };
  networkmanager = {
    enable = lib.mkDefault config.services.xserver.enable;
    #dhcp = "dhcpcd";
    logLevel = lib.mkDefault "INFO";
    wifi = {
      #backend = "iwd";
      #backend = "wpa_supplicant";
      powersave = lib.mkDefault false;
    };
  };
  usePredictableInterfaceNames = true;
};

programs.mtr.enable = true;
programs.usbtop.enable = true;

services.avahi = {
  enable = lib.mkDefault true;
  nssmdns = lib.mkDefault true;
  openFirewall = lib.mkDefault false;
  publish.enable = lib.mkDefault false;
};
networking.nftables.ruleset = lib.mkIf config.services.avahi.enable (''
  table inet filter {
    chain output-lan {
      skuid root udp sport 5353 udp dport 5353 comment "Avahi"
    }
  }
'' + lib.optionalString config.services.avahi.openFirewall ''
  table inet filter {
    chain input-lan {
      udp dport 5353 comment "Avahi"
    }
  }
'');

services.openssh = {
  enable = lib.mkDefault true;
  forwardX11 = lib.mkDefault true;
  openFirewall = lib.mkDefault false;
  listenAddresses = [
    { addr = wg-intra-peers.${hostName}.ipv4; port = 22; }
  ];
};
networking.firewall.extraCommands = lib.mkIf config.services.openssh.enable ''
  ip46tables -A nixos-fw -i wg-intra -p tcp -m tcp --dport 22 -j ACCEPT
'';
systemd.services.sshd.after = ["wireguard-wg-intra.service"];
}