{ config, lib, pkgs, ... }:

{
  networking.firewall.enable = true;
  networking.firewall.allowedTCPPorts = [ 80 443 ];

  networking.nftables.enable = true;
  networking.nftables.tables.nat = {
    family = "ip";
    content = ''
      chain prerouting {
        type nat hook prerouting priority dstnat; policy accept;

        iifname "enp1s0" tcp dport 80 dnat to 10.0.0.2:80
        iifname "enp1s0" tcp dport 443 dnat to 10.0.0.2:443
      }
	    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;

        oifname "wg0" masquerade
      }
    '';
  };

  boot.kernel.sysctl = {
    "net.ipv4.ip_forward" = 1;
  };
}