{ config, pkgs, lib, hostName, ... }:
let
  wg-intra-peers = import wireguard/wg-intra/peers.nix;
in
{
imports = [
  networking/nftables.nix
];
networking = {
  hostName = hostName;
  domain = lib.mkDefault "wg";
  #search = [ "sourcephile.fr" ];
  firewall = {
    enable = lib.mkDefault true;
    allowPing = lib.mkDefault true;
  };
  networkmanager = {
    enable = lib.mkDefault config.services.xserver.enable;
    #dhcp = "dhcpcd";
    logLevel = lib.mkDefault "INFO";
    wifi = {
      #backend = "iwd";
      #backend = "wpa_supplicant";
      powersave = lib.mkDefault false;
    };
  };
  usePredictableInterfaceNames = true;
};

programs.mtr.enable = true;
programs.usbtop.enable = true;
environment.systemPackages = [
  pkgs.iperf
];

services.avahi = {
  enable = lib.mkDefault true;
  nssmdns = lib.mkDefault true;
  openFirewall = lib.mkDefault false;
  publish.enable = lib.mkDefault false;
};
networking.nftables.ruleset = lib.mkIf config.services.avahi.enable (''
  table inet filter {
    chain output-lan {
      skuid root udp sport mdns udp dport mdns comment "avahi: multicast DNS"
    }
  }
'' + lib.optionalString config.services.avahi.openFirewall ''
  table inet filter {
    chain input-lan {
      udp dport mdns comment "avahi: multicast DNS"
    }
  }
'');

services.openssh = {
  enable = lib.mkDefault true;
  forwardX11 = lib.mkDefault true;
  openFirewall = lib.mkDefault false;
  # Enable to switch-to-configuration
  # with the same remotely and locally
  listenAddresses = [
    { addr = "127.0.0.1"; port = 22; }
  ];
};

environment.etc."NetworkManager/dispatcher.d/congctl" = {
  mode = "700";
  source = pkgs.writeShellScript "congctl" ''
    case $NM_DISPATCHER_ACTION in
      up)
        case $DEVICE_IP_IFACE in
          # WLAN or WWAN
          # https://en.wikipedia.org/wiki/TCP_congestion_control#TCP_Westwood+
          wl*|ww*)
            ip route show dev $DEVICE_IP_IFACE |
            while read -r route; do
              ip route change $route dev $DEVICE_IP_IFACE congctl westwood
            done
            ip r >>/tmp/log
          ;;
        esac
      ;;
    esac
  '';
};
}