{ config, lib, pkgs, ... }: {
  imports = [ ./forwarding.nix ];
  config = lib.mkIf (config.syscfg.net.wg.enable) {
    networking.wireguard = {
      enable = true;
      interfaces = {
        wg0 = {
          ips = [ config.syscfg.net.wg.ip4 config.syscfg.net.wg.ip6 ];
          privateKeyFile =
            config.sops.secrets."${config.syscfg.hostname}_wg_priv".path;
          listenPort = 1515;
          mtu = 1340;
          postSetup = if config.syscfg.net.wg.server.enable then ''
          for keyfile in /run/secrets/*_wg_pub; do
            if [ -f "$keyfile" ]; then
              ${pkgs.wireguard-tools}/bin/wg set wg0 \
                peer "$(cat "$keyfile")" \
                allowed-ips 10.10.1.0/24,fd10:10:10::0/64
            fi
          done
          '' else '''';
          peers = 
            if config.syscfg.net.wg.server.enable then
              []
            else
              [{
                allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
                endpoint = "vpn.helcel.net:1515";
                publicKey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
                persistentKeepalive = 30;
              }];
        };
      };
    };
  };
}