{
  config,
  pkgs,
  lib,
  ...
}:
let
  wan = config.networking.nat.externalInterface;
  lans = config.networking.nat.internalInterfaces;
  lan = builtins.head lans;
  tailnet = "fin-marlin.ts.net";

  inherit (config.networking) domain hostName;

  wanPrefixLen = 56;

  modem = {
    hostname = "modem";

    deviceAddr = "192.168.100.1";
    ourAddr = "192.168.100.10";
  };

  nameservers = [
    "2620:fe::fe"
    "2620:fe::9"
    "9.9.9.9"
    "149.112.112.112"
  ];
  nsTLSHostname = "dns.quad9.net";
in
{
  imports = [
    ../settings/services/adguard-home.nix
  ];

  networking = {
    useDHCP = false;
    hosts = {
      "${modem.deviceAddr}" = [
        "${modem.hostname}.${domain} ${modem.hostname}"
      ];
    };
    nameservers = lib.mkForce [ "::1" ];

    nat = {
      # TODO upstream changes somehow
      enable = false; # NixOS module is a bit limiting
    };
    firewall = {
      enable = true;
      trustedInterfaces = lans;
      filterForward = true;
      extraForwardRules = ''
        iifname "${lan}"  oifname "${wan}" accept comment "from internal interfaces"
      '';
      interfaces = {
        "${lan}" = {
          allowedTCPPorts = [ 22 ];
        };
      };
    };
    nftables = {
      enable = true;
      tables = {
        nat = {
          family = "ip";
          content = ''
            chain pre {
              type nat hook prerouting priority dstnat; policy accept;
            }

            chain post {
              type nat hook postrouting priority srcnat; policy accept;
              iifname "${lan}" oifname "${wan}" ip daddr ${modem.deviceAddr}/24 snat to ${modem.ourAddr} comment "half-bridge modem access";
              iifname "${lan}" oifname "${wan}" masquerade comment "from internal interfaces"
            }

            chain out {
              type nat hook output priority mangle; policy accept;
            }
          '';
        };
      };
    };
  };

  systemd.network = {
    enable = true;
    config = {
      networkConfig = {
        IPv6Forwarding = true;
        IPv6PrivacyExtensions = false;
        SpeedMeter = true;
      };
    };
    networks = {
      "40-${lan}" = rec {
        matchConfig.Name = lan;
        address = [
          "fd12:d04f:65d:42::1/56"
          "10.0.0.1/16"
        ];
        addresses = [
          {
            Address = "fe80::1/64";
            Scope = "link";
          }
        ];
        networkConfig = {
          IPv6AcceptRA = false;
          DHCPPrefixDelegation = true;
          ConfigureWithoutCarrier = true;
          MulticastDNS = true;
          Domains = [ config.networking.domain ];
          LinkLocalAddressing = "ipv6"; # required for networkd RA despite fe80::1 static assignment
          DNS = map (a: builtins.head (lib.strings.splitString "/" a)) address;
          DNSDefaultRoute = false;
          IPv6SendRA = true;
        };
        dhcpPrefixDelegationConfig = {
          UplinkInterface = wan;
          SubnetId = "42";
          Assign = true;
          Announce = true;
          Token = "::1";
        };
        ipv6SendRAConfig = {
          Managed = true;
          OtherInformation = true;
          DNS = [ "_link_local" ];
        };
        ipv6Prefixes = [
          {
            Prefix = "fd12:d04f:65d:42::/56";
            AddressAutoconfiguration = false;
            Assign = false;
          }
        ];
      };
      "40-${wan}" = {
        matchConfig.Name = wan;
        networkConfig = {
          DHCP = true; # this enables DHCPv6
          IPv6AcceptRA = true;
          IPv4Forwarding = true;
          MulticastDNS = false;
          DNSDefaultRoute = true;
          DNSOverTLS = true;
          DNS = "::1";
        };
        dhcpV4Config = {
          UseDNS = false;
          SendHostname = false;
          UseHostname = false;
          Label = "${wan}:1";
        };
        dhcpV6Config = {
          UseDNS = false;
          UseAddress = true; # necessary for dynamic DNS
          SendHostname = false;
          PrefixDelegationHint = "::/${toString wanPrefixLen}";
        };
        dhcpPrefixDelegationConfig = {
          UplinkInterface = ":self";
        };
        ipv6AcceptRAConfig = {
          UseDNS = false;
        };
        addresses = [
          {
            Address = "${modem.ourAddr}/24";
            Label = "${wan}:0";
            Scope = "link";
          }
        ];
        routes = [
          {
            Gateway = "_dhcp4";
            InitialCongestionWindow = 30;
            InitialAdvertisedReceiveWindow = 30;
          }
          {
            Gateway = "_ipv6ra";
            InitialCongestionWindow = 30;
            InitialAdvertisedReceiveWindow = 30;
          }
        ];
        cakeConfig = {
          Bandwidth = "20M";
          OverheadBytes = 18;
          MPUBytes = 64;
          CompensationMode = "none";
          NAT = true;
          RTTSec = "100ms";
          AckFilter = true;
          PriorityQueueingPreset = "diffserv8";
        };
      };
    };
  };

  services.adguardhome.settings = {
    dns = {
      upstream_dns = [ "tls://${nsTLSHostname}" ];
      bootstrap_dns = nameservers;
      bootstrap_prefer_ipv6 = true;
    };
  };

  services.resolved = {
    enable = true;
    settings.Resolve = {
      DNS = [ "" ];
      FallbackDNS = map (ns: "${ns}#${nsTLSHostname}") nameservers;
      LLMNR = false;
      MulticastDNS = true;
      DNSOverTLS = "opportunistic";
    };
  };
  networking.resolvconf.enable = false;

  services.tailscale.extraSetFlags = [ "--accept-dns=false" ];
  environment.etc."resolv.conf".text = lib.mkForce ''
    nameserver ::1
    search ${domain} ${tailnet}
    options edns0 trust-ad
  '';

  boot.kernelModules = [
    "tcp_lp"
  ];
  boot.kernel.sysctl = {
    "net.ipv4.tcp_slow_start_after_idle" = 0;
    "net.ipv4.tcp_ecn" = 1;
    "net.ipv4.tcp_fastopen" = "0x3";
    "net.core.default_qdisc" = "fq";

    "net.ipv6.conf.all.accept_ra" = 0;
    "net.ipv6.conf.all.autoconf" = 0;
    "net.ipv6.conf.default.autoconf" = 0;
    "net.ipv6.conf.${wan}.autoconf" = 0;
  };

  networking.tempAddresses = "disabled"; # use_tempaddr = 0

  services.ddclient = {
    usev4 = "disabled";
    usev6 = "ifv6, ifv6=${wan}";
  };

  environment.systemPackages = [
    config.services.dnsmasq.package
  ];
  services.dnsmasq = {
    enable = true;
    alwaysKeepRunning = true;
    resolveLocalQueries = false;
    settings = {
      inherit domain;
      interface = [
        lan
      ];
      except-interface = [ "lo" ];
      bind-interfaces = true;
      enable-ra = false;

      dhcp-fqdn = true;
      dhcp-authoritative = true;
      dhcp-rapid-commit = true;
      dhcp-range = [
        "10.0.1.10,10.0.250.250,48h"
        "fd12:d04f:65d:42::10,fd12:d04f:65d:42::ffff,64,48h"
      ];

      no-resolv = true;
      server = [ "::1" ];
      dns-loop-detect = true;

      # these next few settings imply trust of the upstream resolver and the path to it
      query-port = 0; # use single OS-allocated port: faster and more efficient
      proxy-dnssec = true; # resolved handles dnssec and is caching
      cache-size = 0; # let resolved do it

      # resolved may know about single-label names
      # particularly those it synthesises, such as "_gateway" (see systemd-resolved(8))
      domain-needed = false;
      stop-dns-rebind = false; # necessary for above

      # do not forward reverse lookups for private addresses, respond nxdomain
      # (resolved will not know more than dnsmasq in such cases)
      bogus-priv = true;

      quiet-ra = true;

      # resolved will look there anyway
      no-hosts = true;

      localise-queries = true;
      local = [
        "/${domain}/"
      ];
      local-ttl = 1; # defaults to 0 (client should not cache), but 1s shouldn't hurt
      interface-name = [
        "${hostName},${lan}" # prevents returning 127.0.0.2
        "${hostName}.${domain},${lan}" # prevents returning 127.0.0.2
        "wan.${domain},${wan}/6"
      ];
    };
  };
}