{
  config,
  lib,
  ...
}:
let
  wan = config.networking.nat.externalInterface;
  lans = config.networking.nat.internalInterfaces;
  lan = builtins.head lans;
  tailnet = "fin-marlin.ts.net";

  inherit (config.networking) domain hostName;

  dnsmasqEnable = true;

  wanPrefixLen = 56;

  nameservers = [
    "2620:fe::fe"
    "2620:fe::9"
    "9.9.9.9"
    "149.112.112.112"
  ];
  nsTLSHostname = "dns.quad9.net";
in
{
  networking = {
    useDHCP = false;
    hosts = {
      "192.168.100.1" = [
        "modem.home.arpa"
      ];
    };
    nameservers = lib.mkForce [ "::1" ];

    nat = {
      enable = true;
    };
    firewall = {
      enable = true;
      trustedInterfaces = lans;
      filterForward = true;
    };
    nftables = {
      enable = true;
    };
  };

  systemd.network = {
    enable = true;
    config = {
      networkConfig = {
        IPv6Forwarding = true;
      };
    };
    networks = {
      "40-${lan}" = rec {
        matchConfig.Name = lan;
        address = [
          "fd12:d04f:65d:42::1/56"
          "10.0.0.1/16"
        ];
        addresses = [
          {
            Address = "fe80::1/64";
            Scope = "link";
          }
        ];
        networkConfig = {
          IPv6AcceptRA = false;
          DHCPPrefixDelegation = true;
          ConfigureWithoutCarrier = true;
          MulticastDNS = true;
          Domains = [ config.networking.domain ];
          LinkLocalAddressing = false;
          IPv6SendRA = !dnsmasqEnable;
          DHCPServer = !dnsmasqEnable;
          DNS = map (a: builtins.head (lib.strings.splitString "/" a)) address;
          DNSOverTLS = false;
          DNSDefaultRoute = false;
        };
        dhcpPrefixDelegationConfig = {
          UplinkInterface = wan;
          SubnetId = "42";
          Assign = true;
          Token = "::1";
        };
      };
      "40-${wan}" = {
        matchConfig.Name = wan;
        networkConfig = {
          DHCP = true;
          IPv6AcceptRA = true;
          IPv4Forwarding = true;
          MulticastDNS = false;
          DNSDefaultRoute = true;
          DNSOverTLS = true;
          DNSSEC = true;
          DNS = map (ns: "${ns}#${nsTLSHostname}") nameservers;
        };
        dhcpV4Config = {
          UseDNS = false;
          SendHostname = false;
          UseHostname = false;
          Label = "${wan}:1";
        };
        dhcpV6Config = {
          UseDNS = false;
          SendHostname = false;
          RapidCommit = true;
          PrefixDelegationHint = "::/${toString wanPrefixLen}";
        };
        dhcpPrefixDelegationConfig = {
          UplinkInterface = ":self";
        };
        ipv6AcceptRAConfig = {
          UseDNS = false;
        };
        addresses = [
          {
            Address = "192.168.100.10/24";
            Peer = "192.168.100.1/32";
            Label = "${wan}:0";
            Scope = "link";
          }
        ];
        routes = [
          {
            Gateway = "_dhcp4";
            InitialCongestionWindow = 30;
            InitialAdvertisedReceiveWindow = 30;
          }
          {
            Gateway = "_ipv6ra";
            InitialCongestionWindow = 30;
            InitialAdvertisedReceiveWindow = 30;
          }
        ];
        cakeConfig = {
          Bandwidth = "24M";
          OverheadBytes = 18;
          MPUBytes = 64;
          CompensationMode = "none";
          NAT = true;
          RTTSec = "100ms";
          AckFilter = true;
          PriorityQueueingPreset = "diffserv8";
        };
      };
    };
  };

  services.resolved = {
    enable = true;
    settings.Resolve = {
      DNS = [ "" ];
      FallbackDNS = map (ns: "${ns}#${nsTLSHostname}") nameservers;
      LLMNR = false;
      MulticastDNS = true;
      DNSOverTLS = "opportunistic";
      DNSStubListener = false;
      DNSStubListenerExtra = [ "[::1]:90" ];
    };
  };
  networking.resolvconf.enable = false;

  services.tailscale.extraSetFlags = [ "--accept-dns=false" ];
  environment.etc."resolv.conf".text = lib.mkForce ''
    nameserver ::1
    search home.arpa ${tailnet}
    options edns0 trust-ad
  '';

  boot.kernelModules = [
    "tcp_lp"
  ];
  boot.kernel.sysctl = {
    "net.ipv4.tcp_slow_start_after_idle" = 0;
    "net.ipv4.tcp_ecn" = 1;
    "net.ipv4.tcp_fastopen" = "0x3";
    "net.core.default_qdisc" = "fq";

    "net.ipv6.conf.all.accept_ra" = 0;
    "net.ipv6.conf.all.autoconf" = 0;
    "net.ipv6.conf.all.use_tempaddr" = 0;

    # "net.ipv6.conf.${wan}.accept_ra" = 2;
    "net.ipv6.conf.${wan}.autoconf" = 1;
  };

  services.ddclient = {
    usev4 = "disabled";
    usev6 = "ifv6, ifv6=${wan}";
  };

  services.dnsmasq = {
    enable = dnsmasqEnable;
    alwaysKeepRunning = true;
    resolveLocalQueries = true;
    settings = {
      inherit domain;
      enable-ra = true;

      dhcp-fqdn = true;
      dhcp-authoritative = true;
      dhcp-rapid-commit = true;
      dhcp-range = [
        "10.0.1.10,10.0.250.250,48h"
        "fd12:d04f:65d:42::,slaac,ra-names,48h"
        "::,constructor:${lan},ra-stateless"
      ];

      dns-loop-detect = true;
      stop-dns-rebind = true;
      server = [ "::1#90" ];
      proxy-dnssec = true;
      no-resolv = true;
      cache-size = 0; # let resolved do it

      quiet-dhcp = true;
      quiet-dhcp6 = true;
      quiet-ra = true;

      localise-queries = true;
      expand-hosts = true;
      domain-needed = true;
      local = [
        "/${domain}/"
      ];
      interface-name = [
        "${hostName}.${domain},${lan}"
        "wan.${domain},${wan}"
      ];
    };
  };
}