{ pkgs, lib, config, machines, ... }:
let
  inherit (builtins) hasAttr readFile;
  inherit (pkgs.lib) unlinesAttrs;
  inherit (config.users) users groups;
in
{
networking.firewall.enable = false;
security.lockKernelModules = false;
systemd.services.disable-kernel-module-loading.after = [ "nftables.service" ];
# echo -e "$(nix eval machines.losurdo.config.networking.nftables.ruleset)"
# nft list ruleset
systemd.services.nftables.serviceConfig.TimeoutStartSec = "20";
networking.nftables = {
  enable = true;
  ruleset = lib.mkBefore ''
    table inet filter {
      chain net2fw {
        #udp dport mdns ip6 daddr ff02::fb counter accept comment "Accept mDNS"
        #udp dport mdns ip daddr 224.0.0.251 counter accept comment "Accept mDNS"
        
        # Some .nix append rules here with: add rule inet filter net2fw ...
      }
      chain fw2net {
        ip daddr ${machines.losurdo.extraArgs.ipv4} counter accept comment "losurdo"
        ip daddr ${machines.mermet.extraArgs.ipv4} counter accept comment "mermet"
        ip daddr 224.0.0.0/4 udp dport 1900 counter accept comment "UPnP"
        tcp dport {80,443} counter accept comment "HTTP"
        udp dport 123 skuid ${users.systemd-timesync.name} counter accept comment "NTP"
        tcp dport 9418 counter accept comment "Git"
        
        # Some .nix append rules here with: add rule inet filter fw2net ...
      }
      chain intra2fw {
        # Some .nix append rules here with: add rule inet filter intra2fw ...
      }
      chain fw2intra {
        # Some .nix append rules here with: add rule inet filter fw2intra ...
      }
      chain fwd-intra {
        # Some .nix append rules here with: add rule inet filter fwd-intra ...
      }

      chain input {
        type filter hook input priority 0
        policy drop
    
        iifname lo accept

        # Ping flood limit
        ip protocol icmp icmp type echo-request limit rate over 10/second burst 4 packets log level warn prefix "net2fw: ping flood: " counter drop
        ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate over 10/second burst 4 packets log level warn prefix "net2fw: ping flood: " counter drop
    
        # accept traffic already established
        ct state {established, related} accept
        ct state invalid drop
    
        # admin services
        tcp dport 22 counter accept comment "SSH"
        udp dport 60000-61000 counter accept comment "Mosh"
    
        # ICMP
        ip protocol icmp icmp type { echo-request, destination-unreachable, router-solicitation, router-advertisement, time-exceeded, parameter-problem } counter accept

        ip6 nexthdr icmpv6 icmpv6 type echo-request counter accept
        ip6 nexthdr icmpv6 icmpv6 type nd-neighbor-solicit counter accept
        ip6 nexthdr icmpv6 icmpv6 type nd-neighbor-advert counter accept
        ip6 nexthdr icmpv6 icmpv6 type nd-router-solicit counter accept
        ip6 nexthdr icmpv6 icmpv6 type nd-router-advert counter accept
        ip6 nexthdr icmpv6 icmpv6 type mld-listener-query counter accept
        ip6 nexthdr icmpv6 icmpv6 type mld-listener-report counter accept
        ip6 nexthdr icmpv6 icmpv6 type mld-listener-reduction counter accept
        ip6 nexthdr icmpv6 icmpv6 type destination-unreachable counter accept
        ip6 nexthdr icmpv6 icmpv6 type packet-too-big counter accept
        ip6 nexthdr icmpv6 icmpv6 type time-exceeded counter accept
        ip6 nexthdr icmpv6 icmpv6 type parameter-problem counter accept
        ip6 nexthdr icmpv6 icmpv6 type ind-neighbor-solicit counter accept
        ip6 nexthdr icmpv6 icmpv6 type ind-neighbor-advert counter accept
        ip6 nexthdr icmpv6 icmpv6 type mld2-listener-report counter accept
        ip6 nexthdr icmpv6 log level info prefix "net2fw: icmpv6: " counter accept
        #ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, mld-listener-report, mld-listener-reduction, destination-unreachable, packet-too-big, time-exceeded, parameter-problem, ind-neighbor-solicit, ind-neighbor-advert, mld2-listener-report } counter accept

        # Some .nix append gotos here with: add rule inet filter input iffname ... goto ...
      }
      chain output {
        type filter hook output priority 0
        policy drop

        oifname lo accept

        ct state {related,established} accept
        ct state invalid drop

        # ICMP
        ip protocol icmp counter accept
        ip6 nexthdr icmpv6 counter accept

        tcp dport 22 counter accept comment "SSH"

        # Some .nix append gotos here with: add rule inet filter output oifname ... goto ...
      }
      chain forward {
        type filter hook forward priority 0
        policy drop
      }
    }
  '';
};
}