{ config, pkgs, ... }:
let
  mwnSubnetsPublic =
    [ "129.187.0.0/16" "141.40.0.0/16" "141.84.0.0/16"
      "192.68.211.0/24" "192.68.212.0/24" "192.68.213.0/24" "192.68.214.0/24" "192.68.215.0/24"
      "193.174.96.0/22"
      "194.95.59.0/24"
    ];
  mwnSubnetsPrivate =
    [ "10.153.0.0/16" "10.162.0.0/16" "10.156.0.0/16"
    ];
in {
  config = {
    systemd.network = {
      config.routeTables.wgrz = 1025;
      netdevs = {
        wgrz = {
          netdevConfig = {
            Name = "wgrz";
            Kind = "wireguard";
            MTUBytes = "1558";
          };
          wireguardConfig = {
            PrivateKeyFile = "/run/credentials/systemd-networkd.service/wgrz.priv";
            ListenPort = 51822;
            # FirewallMark = 1;
          };
          wireguardPeers = [
            { AllowedIPs = [ "10.200.116.1/32" "10.163.88.40/32" ] ++ mwnSubnetsPrivate ++ mwnSubnetsPublic;
              PublicKey = "YlRFLc+rD2k2KXl7pIJbOKbcPgdJCl8ZTsv0xlK4VEI=";
              PersistentKeepalive = 25;
              Endpoint = "wg.math.lmu.de:51820";
            }
          ];
        };
      };
      networks = {
        wgrz = {
          name = "wgrz";
          matchConfig = {
            Name = "wgrz";
          };
          address = ["10.200.116.131/24"];
          routes = map (Destination: {
            inherit Destination;
            Gateway = "10.200.116.1";
            GatewayOnLink = true;
            Table = "wgrz";
          }) (mwnSubnetsPrivate ++ mwnSubnetsPublic ++ ["10.163.88.40/32"]);
          routingPolicyRules = [
            { Table = "main";
              # FirewallMark = 1;
              To = "129.187.111.225";
              Priority = 100;
            }
            { Table = "main";
              To = "10.153.91.204";
              Priority = 100;
            }
            { Table = "wgrz";
              From = "10.200.116.131";
              Priority = 200;
            }
            { Table = "wgrz";
              To = "10.163.88.40";
              Priority = 200;
            }
          ] ++ map (To: { Table = "wgrz";
                          inherit To;
                          Priority = 200;
                        }) (mwnSubnetsPrivate ++ mwnSubnetsPublic);
          linkConfig = {
            RequiredForOnline = false;
          };
          networkConfig = {
            LLMNR = false;
            MulticastDNS = false;
            DNS = ["10.153.88.9" "129.187.111.202" "10.156.33.53"];
            # Tunnel = "rz-gre-1";
          };
        };
      };
    };
    networking.networkmanager.unmanaged = ["wgrz"];
    sops.secrets.wgrz = {
      format = "binary";
      sopsFile = ./wgrz.priv;
    };
    systemd.services."systemd-networkd".serviceConfig.LoadCredential = [
      "wgrz.priv:${config.sops.secrets.wgrz.path}"
    ];

    environment.etc."NetworkManager/dnsmasq.d/wgrz.conf" = {
      text = ''
        server=/mathinst.loc/10.153.88.9@wgrz
        server=/cipmath.loc/10.153.88.9@wgrz
      '';
    };

    home-manager.users.gkleen = { sysConfig, config, ... }: {
      home.persistence."/persistent".files = [
        "rz.kdbx" ".config/Element-lmu"
      ];

      xdg.desktopEntries = {
        element-lmu = {
          name = "Element (LMU)";
          exec = "element-desktop --profile=lmu %u";
          icon = "element";
          genericName = "Matrix Client";
          categories = [ "Network" "InstantMessaging" "Chat" ];
          settings = {
            StartupWMClass = "Element";
          };
        };
        thunderbird-lmu = {
          name = "Thunderbird (LMU)";
          exec = "thunderbird --name thunderbird -P lmu %U";
          icon = "thunderbird";
          genericName = "Email Client";
          categories = [ "Network" "Chat" "Email" "Feed" "GTK" "News" ];
          settings = {
            StartupWMClass = "thunderbird";
            StartupNotify = "true";
          };
        };
      };

      programs.zsh.dirHashes = {
        u2w = "$HOME/projects/uni2work";
        rz = "$HOME/projects/rz";
        pro = "$HOME/projects/pro";
      };

      programs.ssh.matchBlocks = {
        "*.mathinst.loc" = {
          match = "host *.mathinst.loc,*.cipmath.loc,*.math.lmu.de";
          identityFile = "~/.ssh/gkleen@mathinst.loc";
          extraOptions = {
            HostKeyAlgorithms = "+ssh-rsa";
            PubkeyAcceptedAlgorithms = "+ssh-rsa";
            PasswordAuthentication = "yes";
            GlobalKnownHostsFile = toString (pkgs.writeText "ssh_known_hosts" ''
              @cert-authority *.mathinst.loc,*.math.lmu.de,*.cipmath.loc ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBUTFpVCdETCXiDSDl7YGbR1J4BLTsoBzjDtflHJGO/z ssh-pki@mgmt01
            '');
          };
        };
      };

      home.file = {
        ".cups/client.conf".text = ''
          ServerName cups.mathinst.loc
        '';
      };

      home.packages = with pkgs; [
        cups
      ];
    };
  };
}