{ config, lib, pkgs, ... }:

let
  me = config.network.nodes.${config.network.node};
in
{
  networking = {
    firewall = {
      allowedUDPPorts = [ 51820 ];
	    trustedInterfaces = [ "wg0" ];
	  };
	  wireguard.interfaces."wg0" = {
      ips = [ "${me.address-vpn}/24" ];
	    listenPort = 51820;
	    generatePrivateKeyFile = true;
	    privateKeyFile = "/var/lib/wireguard/wg0.key";
	    peers = lib.mapAttrsToList (name: peer: {
        publicKey = peer.vpn;
		    allowedIPs =
		      if config.network.node == "vps"
			      then [ "${peer.address-vpn}/32" ]
			      else [ "10.0.0.0/24" ];
		    endpoint =
		      if peer.address-pub != null
			      then "${peer.address-pub}:51820"
			      else null;
		    persistentKeepalive =
		      if peer.address-pub != null
			      then 25
			      else null;
	    }) (lib.filterAttrs (name: _:
        if config.network.node == "vps"
		      then name != "vps"
          else name == "vps"
      ) config.network.nodes);
	  };
  };
}