{ pkgs, lib, config, hosts, ... }:
let
  iface = "wlp4s0";
  gateway = "enp5s0";
  #gateway = config.networking.defaultGateway.interface;
in
{
environment.systemPackages = [
  pkgs.iw
];
networking.interfaces.${iface} = {
  ipv4.addresses = [ { address = "192.168.2.1"; prefixLength = 24; } ];
};
# Not merged, even though all are 1
#boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
boot.kernel.sysctl."net.ipv6.conf.${iface}.addr_gen_mode" = 1;
networking.nftables.ruleset = ''
  add chain inet filter wifi2fw
  add chain inet filter fw2wifi
  add rule inet filter input iifname "${iface}" goto wifi2fw
  add rule inet filter output oifname "${iface}" goto fw2wifi

  # ${iface} firewalling
  add rule inet filter fw2wifi counter accept

  # Allow forwarding to the internet
  add rule inet filter forward iifname "${iface}" oifname "${gateway}" counter accept
  add rule inet filter forward iifname "${gateway}" oifname "${iface}" counter accept

  # Allow networking services
  add rule inet filter wifi2fw meta l4proto { udp, tcp } th dport 53 counter accept comment "DNS"
  add rule inet filter wifi2fw tcp dport 67 counter accept comment "DHCP"
'';

services.unbound.settings = {
  server = {
    interface = [ "192.168.2.1" ];
    access-control = ["192.168.2.0/24 allow"];
    local-zone = [
      "tracking.intl.miui.com always_refuse"
      "sourcephile.fr typetransparent"
    ];
    local-data = [
      "\"bureau1.sourcephile.fr A 192.168.2.1\""
    ];
  };
};

networking.wlanInterfaces.${iface} = {
  device = "phy0";
};

/*
networking.networkmanager.unmanaged = [
  "interface-name:phy0"
  "interface-name:${iface}"
];
*/

# iw dev wlp4s0 station dump
# DOC: https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf
services.hostapd = {
  enable = true;
  logLevel = 2;
  interface = iface;
  hwMode = "g";
  ssid = "bureau1";
  wpa = true;
  wpaPassphrase = "bidonpoissonmaisonronron";
  countryCode = "FR";
  extraConfig = ''
    # WLAN
    beacon_int=100
    dtim_period=2 # DTIM (delivery trafic information message)
    preamble=1
    # limit the frequencies used to those allowed in the country
    ieee80211d=1
    # 0 means the AP will search for the channel with the least interferences (ACS)
    channel=1

    # WPA2
    wpa_key_mgmt=WPA-PSK
    wpa_pairwise=CCMP
    rsn_pairwise=CCMP
    auth_algs=1 # 0=noauth, 1=wpa, 2=wep, 3=both
    macaddr_acl=0
    # QoS support, also required for full speed on 802.11n/ac/ax
    wmm_enabled=1
    eap_reauth_period=360000
    wpa_group_rekey=600
    wpa_ptk_rekey=600
    wpa_gmk_rekey=86400

    # N-WLAN
    ieee80211n=1
    # See Capabilities in iw list
    ht_capab=[HT40+][SHORT-GI-40][DSSS_CCK-40][MAX-AMSDU-7935]
    require_ht=1
    obss_interval=0

    # 802.11ac support
    ieee80211ac=0
  '';
};
systemd.services."dhcpd4" = {
  after = [ "network-addresses-${iface}.service" ];
  requires = [
    "network-addresses-${iface}.service"
    "sys-subsystem-net-devices-${iface}.device"
  ];
};
services.dhcpd4 = {
  enable = true;
  interfaces = [ iface ];
  extraConfig = ''
    option subnet-mask 255.255.255.0;
    option broadcast-address 192.168.2.255;
    option routers 192.168.2.1;
    option domain-name-servers 192.168.2.1;
    subnet 192.168.2.0 netmask 255.255.255.0 {
      range 192.168.2.100 192.168.2.200;
    }
  '';
};

#networking.firewall.allowedUDPPorts = [ 53 67 ]; # DNS & DHCP
/*
# Sometimes slow connection speeds are attributed to absence of haveged.
services.haveged.enable = true;
*/

/*

systemd.services.wifi-relay = let inherit (pkgs) iptables gnugrep;
in {
  description = "iptables rules for wifi-relay";
  after = [ "dhcpd4.service" ];
  wantedBy = [ "multi-user.target" ];
  script = ''
    ${iptables}/bin/iptables -w -t nat -I POSTROUTING -s 192.168.2.0/24 ! -o wlan-ap0 -j MASQUERADE
    ${iptables}/bin/iptables -w -I FORWARD -i wlan-ap0 -s 192.168.2.0/24 -j ACCEPT
    ${iptables}/bin/iptables -w -I FORWARD -i wlan-station0 -d 192.168.2.0/24 -j ACCEPT
  '';
};
*/
}