{
  config,
  lib,
  pkgs,
  ...
}:
{
  options.bchmnn = {
    network = {
      nm = {
        enable = lib.mkEnableOption "nm";
      };
      resolved = {
        enable = lib.mkEnableOption "resolved";
      };
      networkd = {
        enable = lib.mkEnableOption "networkd";
      };
    };
    collections = {
      vpn = {
        dryborg = {
          enable = lib.mkEnableOption "dryborg";
        };
      };
    };
  };
  config = {
    networking = {
      networkmanager.enable = config.bchmnn.network.nm.enable;
    };

    systemd.services = lib.mkIf (config.bchmnn.network.nm.enable) {
      NetworkManager-wait-online.enable = false;
    };

    services.resolved.enable = (
      config.bchmnn.network.nm.enable || config.bchmnn.collections.vpn.enable
    );

    environment.systemPackages = lib.optionals (config.bchmnn.collections.vpn.enable) [
      pkgs.openvpn3
      pkgs.mullvad-vpn
      pkgs.wireguard-tools # tools for the wireguard secure network tunnel
    ];
    services.mullvad-vpn.enable = config.bchmnn.collections.vpn.enable;

    age.secrets =
      lib.mkIf (config.bchmnn.collections.vpn.enable && config.bchmnn.collections.vpn.dryborg.enable)
        {
          keys-wireguard-dryborg-privatekey = {
            file = ../../secrets/keys/wireguard/dryborg/privatekey.age;
          };
          keys-wireguard-dryborg-presharedkey = {
            file = ../../secrets/keys/wireguard/dryborg/presharedkey.age;
          };
        };

    networking.wg-quick.interfaces =
      lib.mkIf (config.bchmnn.collections.vpn.enable && config.bchmnn.collections.vpn.dryborg.enable)
        {
          "vpn.dryb.org" = {
            autostart = false;
            privateKeyFile = config.age.secrets.keys-wireguard-dryborg-privatekey.path;
            address = [ "10.200.200.1/24" ];
            dns = [ "192.168.2.1" ];
            peers = [
              {
                publicKey = "JY5fb0RS7C8WyPPEeymzuMSUeIhDtICGk1FYJgTRnTs=";
                presharedKeyFile = config.age.secrets.keys-wireguard-dryborg-presharedkey.path;
                allowedIPs = [ "0.0.0.0/0" ];
                endpoint = "vpn.dryb.org:53280";
                persistentKeepalive = 21;
              }
            ];
          };
        };
  };
}