{ config, pkgs, lib, ... }:
{
  environment.systemPackages = [ pkgs.wireguard-tools pkgs.mosh ];
  networking.nat = {
    enable = true;
    externalInterface = "ens3";
    internalInterfaces = [ "wg0" ];
  };
  networking.firewall = {
    allowedUDPPorts = [ 60990 ];
  };

  networking.wireguard.interfaces.wg0 = {
    ips = [ "10.0.69.1/24" ];
    listenPort = 60990;
    privateKeyFile = "/var/lib/wireguard/priv";
    generatePrivateKeyFile = true; # TODO agenix secret
    peers = [
      {
        # box
        publicKey = "OnvVM1UaX0nmdohzSDyl90VKwd4VUpJZ+4oBpkkytwU=";
        allowedIPs = [ "10.0.69.4/32" ];
      }
      {
        # line
        publicKey = "fsb1FuGmYi89p4CVXytKw2FYamONKtoanxrgs/dJjC8=";
        allowedIPs = [ "10.0.69.3/32" ];
      }
      {
        # curve
        publicKey = "zkC7IzXX16i2ixqnRrPlUq2fD2/4noe84FlZBFaDBEE=";
        allowedIPs = [ "10.0.69.2/32" ];
      }
      {
        # helix
        publicKey = "gcdq86hhEUlqF2chqYB/F8pALyAMNFvwLycxBoHuoDs=";
        allowedIPs = [ "10.0.69.5/32" ];
      }
      {
        # hyperplane
        publicKey = "v+EUuM60yZLvBmdCG9GxfFAtSjS1VvbUWcyNb8emjDg=";
        allowedIPs = [ "10.0.69.6/32" ];
      }
      {
        # work
        publicKey = "/gv66s8DfppCCjaEN/jlc8z95IhEWPgDumykqKEl0QU=";
        allowedIPs = [ "10.0.69.7/32" ];
      }
    ];
  };
}