{
  config,
  hostname,
  pkgs,
  ...
}:
{
  imports = [
    ./wireguard.nix
    ./tailscale.nix
  ];
  sops.secrets = {
    "wg0/conf".sopsFile = ./secrets/vpn.yaml;
    "wg-br0/conf".sopsFile = ./secrets/vpn.yaml;
    "wg-us0/conf".sopsFile = ./secrets/vpn.yaml;
    "wg-uk0/conf".sopsFile = ./secrets/vpn.yaml;
  };

  services.tailscale-netns = {
    enable = true;
    instances.work = {
      extraDaemonFlags = [ "--accept-routes=false" ];
    };
  };

  networking = {
    hostName = hostname;
    networkmanager.enable = false;
    nameservers = [ "192.168.88.3" ];
    useDHCP = false;
    useNetworkd = true;

    # vlans.vlan66 = {
    #   id = 66;
    #   interface = "br0";
    # };
    # interfaces = {
    #   br0.useDHCP = true;
    #   vlan66.useDHCP = true;
    # };
    # bridges.br0 = {
    #   interfaces = [ inetInterface ];
    # };
    firewall.allowedTCPPorts = [
      5900
      8080
      9003
      10000
      10001
      11000
      11001
      12000
      12001
      13000
      13001
    ];
  };

  systemd.network = {
    enable = true;
    netdevs."20-br0" = {
      netdevConfig = {
        Kind = "bridge";
        Name = "br0";
      };
    };

    networks."10-tap" = {
      matchConfig.Name = [
        "en*"
        "eth*"
      ];
      networkConfig.Bridge = "br0";
    };

    networks."20-br0" = {
      matchConfig.Name = "br0";
      networkConfig = {
        DHCP = "yes";
      };
      linkConfig.RequiredForOnline = "routable";
    };

    networks."30-vm-1" = {
      matchConfig.Name = "vm-1";
      address = [ "10.0.0.1/24" ];
      networkConfig.IPMasquerade = "both";
    };

  };

  networking.nat = {
    enable = true;
    internalInterfaces = [ "vm-*" ];
    externalInterface = "br0";
  };

  services.resolved = {
    enable = true;
    settings = {
      Resolve = {
        Domains = [ "~." ];
        FallbackDNS = null;
      };
    };
  };

  services.wireguard-netns = {
    enable = true;
    namespaces = {
      wg0 = {
        dns = "10.2.0.1";
        address = "10.2.0.2/32";
        conf = "wg0/conf";
      };
      wg-br0 = {
        dns = "10.2.0.1";
        address = "10.2.0.2/32";
        conf = "wg-br0/conf";
      };
      wg-us0 = {
        dns = "10.2.0.1";
        address = "10.2.0.2/32";
        conf = "wg-us0/conf";
      };
      wg-uk0 = {
        dns = "10.2.0.1";
        address = "10.2.0.2/32";
        conf = "wg-uk0/conf";
      };
    };
  };
}