@@ -5,12 +5,15 @@ }:
 let
   hostName = "r5";
   domain = "home.arpa";
-  tailnet = "fin-marlin.ts.net";
+
+  wan = "wan0";
+  bridge = "br0";
 in
 {
   imports = [
     ../roles/home.nix
     ../roles/server.nix
+    ../roles/router.nix
   ];
   age.secrets = {
     acme.file = ../../secrets/acme.age;
@@ -18,35 +21,41 @@ syncthing.file = ../../secrets/syncthing.age;
   };
 
   networking = {
-    useDHCP = true;
     inherit domain hostName;
-    hosts = {
-      "fd7a:115c:a1e0::53" = [
-        "tailscale"
-        "ts"
-      ];
-      "192.168.100.1" = [
-        "modem"
-        "pyur"
-      ];
+    # see ../roles/router.nix for remaining settings
+    nat = {
+      externalInterface = wan;
+      internalInterfaces = [ bridge ];
     };
-    nameservers = [
-      "9.9.9.11"
-      "149.112.112.11"
-      "2620:fe::11"
-      "2620:fe::fe:11"
-    ];
-    nftables.enable = true;
   };
+
   systemd.network = {
-    enable = true;
-  };
-  services.resolved = {
-    enable = true;
-    settings.Resolve = {
-      DNS = [ ];
-      LLMNR = false;
-      MulticastDNS = true;
+    netdevs = {
+      "20-${bridge}" = {
+        netdevConfig = {
+          Kind = "bridge";
+          Name = "${bridge}";
+        };
+      };
+    };
+    networks = {
+      "30-lan1" = {
+        matchConfig.Path = "platform-3c0000000.pcie-*";
+        networkConfig.Bridge = bridge;
+        linkConfig.RequiredForOnline = "enslaved";
+      };
+      "30-lan2" = {
+        matchConfig.Path = "platform-3c0400000.pcie-*";
+        networkConfig.Bridge = bridge;
+        linkConfig.RequiredForOnline = "enslaved";
+      };
+      "40-${bridge}" = {
+        matchConfig.Name = bridge;
+        bridgeConfig = { };
+        linkConfig = {
+          RequiredForOnline = "routable";
+        };
+      };
     };
   };