{
  config,
  pkgs,
  lib,
  ...
}:
let
  wan = config.networking.nat.externalInterface;
  lans = config.networking.nat.internalInterfaces;
  lan = builtins.head lans;

  inherit (config.networking) domain hostName fqdn;

  wanPrefixLen = 56;

  modem = {
    hostname = "modem";

    deviceAddr = "192.168.100.1";
    ourAddr = "192.168.100.10";
  };

  dnsProviders = {
    quad9 = {
      hostname = "dns.quad9.net";
      addresses = [
        "2620:fe::fe"
        "2620:fe::9"
        "9.9.9.9"
        "149.112.112.112"
      ];
    };
    dnssb = {
      hostname = "dot.sb";
      addresses = [
        "2a09::"
        "2a11::"
        "45.11.45.11"
        "185.222.222.222"
      ];
    };
  };

  allProviders = lib.attrValues dnsProviders;
  mainProvider = dnsProviders.quad9;

  justAddress = (a: builtins.head (lib.strings.splitString "/" a));
  myAddresses = map justAddress config.systemd.network.networks."40-${lan}".address;
  isv6 = (lib.strings.hasInfix ":");
  wrapv6 =
    addr:
    if isv6 addr then
      if lib.hasPrefix "[" addr && lib.hasSuffix "]" addr then addr else "[" + addr + "]"
    else
      addr;
in
{
  imports = [
    # ./router/v6only.nix
    ../settings/services/adguard-home.nix
  ];

  networking = {
    useDHCP = false;
    hosts = {
      "${modem.deviceAddr}" = [
        "${modem.hostname}.${domain} ${modem.hostname}"
      ];
    }
    // (lib.genAttrs myAddresses (
      lib.const [
        "${fqdn}"
        "${hostName}"
      ]
    ));
    nameservers = lib.mkForce [ "::1" ];

    nat = {
      # TODO upstream changes somehow
      enable = false; # NixOS module is a bit limiting
    };
    firewall = {
      enable = true;
      trustedInterfaces = lans;
      filterForward = true;
      extraForwardRules = ''
        iifname "${lan}"  oifname "${wan}" accept comment "from internal interfaces"
      '';
      interfaces = {
        "${lan}" = {
          allowedTCPPorts = [ 22 ];
        };
      };
    };
    nftables = {
      enable = true;
      tables = {
        nat = {
          family = "ip";
          content = ''
            chain pre {
              type nat hook prerouting priority dstnat; policy accept;
            }

            chain post {
              type nat hook postrouting priority srcnat; policy accept;
              iifname "${lan}" oifname "${wan}" ip daddr ${modem.deviceAddr}/24 snat to ${modem.ourAddr} comment "half-bridge modem access";
              iifname "${lan}" oifname "${wan}" masquerade comment "from internal interfaces"
            }

            chain out {
              type nat hook output priority mangle; policy accept;
            }
          '';
        };
      };
    };
  };

  systemd.network = {
    enable = true;
    config = {
      networkConfig = {
        IPv6Forwarding = true;
        IPv6PrivacyExtensions = false;
        SpeedMeter = true;
      };
    };
    networks = {
      "40-${lan}" = {
        matchConfig.Name = lan;
        address = [
          "fd12:d04f:65d:42::1/56"
          "10.0.0.1/16"
        ];
        addresses = [
          {
            Address = "fe80::1/64";
            Scope = "link";
          }
        ];
        networkConfig = {
          IPv6AcceptRA = false;
          DHCPPrefixDelegation = true;
          ConfigureWithoutCarrier = true;
          MulticastDNS = true;
          Domains = [ config.networking.domain ];
          LinkLocalAddressing = "ipv6"; # required for networkd RA despite fe80::1 static assignment
          DNSOverTLS = false;
          DNS = map (a: "${wrapv6 a}:${toString config.services.dnsmasq.settings.port}") myAddresses;
          DNSDefaultRoute = false;
          IPv6SendRA = true;
        };
        dhcpPrefixDelegationConfig = {
          UplinkInterface = wan;
          SubnetId = "42";
          Assign = true;
          Announce = true;
          Token = "::1";
        };
        ipv6SendRAConfig = {
          Managed = true;
          OtherInformation = true;
          DNS = (builtins.filter isv6 myAddresses) ++ [ "_link_local" ];
        };
        ipv6Prefixes = [
          {
            Prefix = "fd12:d04f:65d:42::/56";
            AddressAutoconfiguration = false;
            Assign = false;
          }
        ];
      };
      "40-${wan}" = {
        matchConfig.Name = wan;
        networkConfig = {
          DHCP = true; # this enables DHCPv6
          IPv6AcceptRA = true;
          IPv4Forwarding = true;
          MulticastDNS = false;
          DNSDefaultRoute = true;
          DNSOverTLS = true;
          DNS = map (p: map (ns: "${ns}#${p.hostname}") p.addresses) allProviders;
        };
        dhcpV4Config = {
          UseDNS = false;
          SendHostname = false;
          UseHostname = false;
          Label = "${wan}:1";
        };
        dhcpV6Config = {
          UseDNS = false;
          UseAddress = true; # necessary for dynamic DNS
          SendHostname = false;
          PrefixDelegationHint = "::/${toString wanPrefixLen}";
        };
        dhcpPrefixDelegationConfig = {
          UplinkInterface = ":self";
        };
        ipv6AcceptRAConfig = {
          UseDNS = false;
        };
        addresses = [
          {
            Address = "${modem.ourAddr}/24";
            Label = "${wan}:0";
            Scope = "link";
          }
        ];
        routes = [
          {
            Gateway = "_dhcp4";
            InitialCongestionWindow = 30;
            InitialAdvertisedReceiveWindow = 30;
          }
          {
            Gateway = "_ipv6ra";
            InitialCongestionWindow = 30;
            InitialAdvertisedReceiveWindow = 30;
          }
        ];
        cakeConfig = {
          Bandwidth = "20M";
          OverheadBytes = 18;
          MPUBytes = 64;
          CompensationMode = "none";
          NAT = true;
          RTTSec = "100ms";
          AckFilter = true;
          PriorityQueueingPreset = "diffserv8";
        };
      };
    };
  };

  services.adguardhome.settings =
    let
      mkHostPort = (addr: "${wrapv6 addr}:${toString config.services.dnsmasq.settings.port}");
      dnsmasqAddrs = map mkHostPort (builtins.filter isv6 myAddresses);
      mkTLSHost = p: "tls://${p.hostname}";
    in
    {
      dns = {
        upstream_dns = (map mkTLSHost allProviders) ++ [
          # [/domain1/domain2/domainN/]upstreamString
          "[/${domain}/]${lib.strings.join " " dnsmasqAddrs}"
          # [//]: unqualified only
        ];
        bootstrap_dns = mainProvider.addresses;
        bootstrap_prefer_ipv6 = true;

        use_private_ptr_resolvers = true;
        local_ptr_upstreams = dnsmasqAddrs;

        ratelimit = 0;
        refuse_any = false; # the dns query type `ANY`
      };
    };

  services.resolved = {
    enable = true;
    settings.Resolve = {
      DNS = [ "" ];
      FallbackDNS = map (p: map (ns: "${ns}#${p.hostname}") p.addresses) allProviders;
      LLMNR = false;
      MulticastDNS = true;
      DNSOverTLS = true;
      DNSStubListener = false;
    };
  };
  networking.resolvconf.enable = false;

  services.tailscale.extraSetFlags = [ "--accept-dns=false" ];

  boot.kernelModules = [
    "tcp_lp"
  ];
  boot.kernel.sysctl = {
    "net.ipv4.tcp_slow_start_after_idle" = 0;
    "net.ipv4.tcp_ecn" = 1;
    "net.ipv4.tcp_fastopen" = "0x3";
    "net.core.default_qdisc" = "fq";

    "net.ipv6.conf.all.accept_ra" = 0;
    "net.ipv6.conf.all.autoconf" = 0;
    "net.ipv6.conf.default.autoconf" = 0;
    "net.ipv6.conf.${wan}.autoconf" = 0;
  };

  networking.tempAddresses = "disabled"; # use_tempaddr = 0

  services.ddclient = {
    usev4 = "disabled";
    usev6 = "ifv6, ifv6=${wan}";
  };

  environment.systemPackages = [
    config.services.dnsmasq.package
  ];
  services.dnsmasq = {
    enable = true;
    alwaysKeepRunning = true;
    resolveLocalQueries = false;
    settings = {
      domain = "${domain}";
      interface = [
        lan
      ];
      port = 5553;
      enable-ra = false;

      dhcp-fqdn = true;
      dhcp-authoritative = true;
      dhcp-rapid-commit = true;
      dhcp-range = [
        "10.0.1.10,10.0.250.250,48h"
        "fd12:d04f:65d:42::10,fd12:d04f:65d:42::ffff,64,48h"
        # "set:ra6,::,constructor:${lan},ra-stateless"
      ];

      # configure static allocations in /etc/ethers
      # format:
      # [hwaddr] [name|ipv4 address]
      read-ethers = true;
      # use addn-hosts for resolving names of static allocations
      addn-hosts = [ "/etc/dnsmasq-hosts" ];

      dhcp-option = [
        # 0.0.0.0 means the address of the system running dnsmasq
        "option:dns-server,0.0.0.0"
        "option:ntp-server,0.0.0.0"

        # [::] means the *global* address of the system running dnsmasq
        # [fd00::] refers to a ULA
        # [fe80::] refers to a link-local address
        "option6:dns-server,[fd00::],[fe80::]"
      ];

      no-resolv = true;
      dns-loop-detect = true;

      # do not forward reverse lookups for private addresses, respond nxdomain
      # (resolved will not know more than dnsmasq in such cases)
      bogus-priv = true;

      quiet-ra = true;

      expand-hosts = true;

      localise-queries = true;
      local = [
        "/${domain}/"
      ];
      local-ttl = 1; # defaults to 0 (client should not cache), but 1s shouldn't hurt
      interface-name = [
        "wan.${domain},${wan}/6"
      ];
    };
  };
}