{ config, lib, ... }:{
  config = lib.mkIf (true) {
    boot.kernel.sysctl = {
      "net.ipv4.ip_forward" = 1;
      "net.ipv6.conf.all.forwarding" = 1;
    };

    networking.nftables.enable = true;
    networking.nftables.ruleset = ''
      table inet filter {
        chain input {
          type filter hook input priority filter; policy drop;
          ct state established,related accept
          iifname "lo" accept
          tcp dport {5432, 6379} ip saddr { 10.0.0.0/8 169.254.0.0/16 } accept
          tcp dport {80, 443, 22} accept
          udp dport {80, 443, 22} accept
          
        }
      }
      table inet nat {
        chain prerouting {
          type nat hook prerouting priority dstnat; policy accept;
          
          ${lib.concatMapStringsSep "\n" (rule:
            let
              srcInt = builtins.elemAt rule 0;
              dstAddr4 = builtins.elemAt rule 1;
              dstAddr6 = builtins.elemAt rule 2;
              srcPort = toString (builtins.elemAt rule 3);
              dstPort = toString (builtins.elemAt rule 4);
            in ''
                iifname "${srcInt}" tcp dport ${srcPort} counter dnat ip to ${dstAddr4}:${dstPort}
                iifname "${srcInt}" udp dport ${srcPort} counter dnat ip to ${dstAddr4}:${dstPort}

                iifname "${srcInt}" tcp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
                iifname "${srcInt}" udp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
            ''
          ) config.syscfg.server.nftables.ports}
        }
        
        chain postrouting {
          type nat hook postrouting priority srcnat; policy accept;
          oifname { ${lib.concatMapStringsSep ", " (iface: ''"${iface}"'') config.syscfg.server.nftables.ifs} } masquerade
        }
      }
    '';
  };
}