{ pkgs, config, hostName, ... }:
with builtins;
let
  inherit (config) networking;
  netIface = "enp5s0";
  lanNet = "192.168.1.0/24";
in
{
  imports = [
    networking/nftables.nix
    #networking/tor.nix
    networking/nsupdate.nix
    networking/wireless.nix
    networking/openvpn.nix
  ];

  boot.initrd.network = {
    enable = true;
    flushBeforeStage2 = true;
    # This will automatically load the zfs password prompt on login
    # and kill the other prompt so boot can continue
    # The pkill zfs kills the zfs load-key from the console
    # allowing the boot to continue.
    postCommands = ''
      echo >>/root/.profile "zfs load-key ${hostName} && pkill zfs"
    '';
    # Retry DHCP forever (because in case of power failure,
    # the router may take longer to boot).
    # Beware that this is not interruptible with Ctrl-C
    udhcpc.extraArgs = [ "--retries=0" ];
  };

  systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
  systemd.network.enable = true;
  systemd.network.wait-online = {
    enable = false;
  };
  systemd.network.networks = {
    "10-${netIface}" = {
      name = netIface;
      # Start a DHCP Client for IPv4 Addressing/Routing
      DHCP = "ipv4";
      networkConfig = {
        # Accept Router Advertisements for Stateless IPv6 Autoconfiguraton (SLAAC)
        IPv6AcceptRA = true;
        IPv6PrivacyExtensions = true;
        KeepConfiguration = "dhcp-on-stop";
      };
      linkConfig = {
        RequiredForOnline = "no";
      };
    };
  };

  /* WARNING: using ipconfig (the ip= kernel parameter) IS NOT RELIABLE:
     a 91.216.110.35/32 becomes a 91.216.110.35/8
    boot.kernelParams = map
    (ip: "ip=${ip.clientIP}:${ip.serverIP}:${ip.gatewayIP}:${ip.netmask}:${ip.hostname}:${ip.device}:${ip.autoconf}")
    [ { clientIP = netIPv4; serverIP = "";
      gatewayIP = networking.defaultGateway.address;
      netmask = "255.255.255.255";
      hostname = ""; device = networking.defaultGateway.interface;
      autoconf = "off";
    }
    { clientIP = lanIPv4; serverIP = "";
      gatewayIP = "";
      netmask = "255.255.255.0";
      hostname = ""; device = "enp2s0";
      autoconf = "off";
    }
    ];
  */
  /* DIY network config, but a right one */
  /*
    boot.initrd.preLVMCommands = ''
    set -x

    # IPv4 lan
    ip link set ${netIface} up
    ip address add ${lanIPv4}/32 dev ${netIface}
    ip route add ${lanIPv4Gateway} dev ${netIface}
    ip route add ${lanNet} dev ${netIface} src ${lanIPv4} proto kernel
    # NOTE: ${lanIPv4}/24 would not work with initrd's ip, hence ${lanNet}
    ip route add default via ${lanIPv4Gateway} dev ${netIface}

    # IPv6 net
    #ip -6 address add ''${lanIPv6} dev ${netIface}
    #ip -6 route add ''${lanIPv6Gateway} dev ${netIface}
    #ip -6 route add default via ''${lanIPv6Gateway} dev ${netIface}

    ip -4 address
    ip -4 route
    #ip -6 address
    #ip -6 route

    set +x
    '';
  */
  # Workaround https://github.com/NixOS/nixpkgs/issues/56822
  #boot.initrd.kernelModules = [ "ipv6" ];

  # Useless without an out-of-band access, and unsecure
  # (though / may still be encrypted at this point).
  # boot.kernelParams = [ "boot.shell_on_fail" ];

  /*
    # Disable IPv6 entirely until it's available
    boot.kernel.sysctl = {
    "net.ipv6.conf.${netIface}.disable_ipv6" = 1;
    };
  */

  networking = {
    hostName = hostName;
    domain = "sourcephile.fr";

    useDHCP = false;
    enableIPv6 = true;
    /*
      defaultGateway = {
      address = lanIPv4Gateway;
      interface = "${netIface}";
      };
      defaultGateway6 = {
      address = lanIPv6Gateway;
      interface = "${netIface}";
      };
    */
    #nameservers = [ ];
  };

  networking.nftables.ruleset = ''
    table inet filter {
      chain input {
        iifname ${netIface} goto input-net
      }
      chain output {
        oifname ${netIface} jump output-net
        oifname ${netIface} log level warn prefix "output-net: " counter drop
      }
      chain output-net {
        ip daddr ${lanNet} log level info prefix "output-net: lan: " counter accept comment "LAN"
      }
    }
    table inet nat {
      chain postrouting {
        oifname ${netIface} masquerade
      }
    }
  '';
  /*
    security.gnupg.secrets."ipv6/${netIface}/stable_secret" = {};
    # This is only active in stage2, the initrd will still use the MAC-based SLAAC IPv6.
    system.activationScripts.ipv6 = ''
    ${pkgs.procps}/bin/sysctl --quiet net.ipv6.conf.${netIface}.stable_secret="$(cat ${gnupg.secrets."ipv6/${netIface}/stable_secret".path})"
    '';
  */
  environment.systemPackages = [
    pkgs.iodine
  ];
  services.vnstat.enable = true;
}