{ config
, lib
, pkgs
, ...
}:
{
  options.bchmnn = {
    collections = {
      vpn = {
        dryborg = {
          enable = lib.mkEnableOption "dryborg";
        };
      };
    };
  };
  config = {
    networking = {
      networkmanager.enable = true;
    };

    systemd.services = {
      NetworkManager-wait-online.enable = false;
    };

    services.resolved.enable = config.bchmnn.collections.vpn.enable;

    environment.systemPackages = lib.optionals (config.bchmnn.collections.vpn.enable) [
      pkgs.openvpn3
      pkgs.mullvad-vpn
      pkgs.wireguard-tools # tools for the wireguard secure network tunnel
    ];
    services.mullvad-vpn.enable = config.bchmnn.collections.vpn.enable;

    age.secrets = lib.mkIf (config.bchmnn.collections.vpn.enable && config.bchmnn.collections.vpn.dryborg.enable) {
      keys-wireguard-dryborg-privatekey = {
        file = ../../secrets/keys/wireguard/dryborg/privatekey.age;
      };
      keys-wireguard-dryborg-presharedkey = {
        file = ../../secrets/keys/wireguard/dryborg/presharedkey.age;
      };
    };

    networking.wg-quick.interfaces = lib.mkIf (config.bchmnn.collections.vpn.enable && config.bchmnn.collections.vpn.dryborg.enable) {
      "vpn.dryb.org" = {
        autostart = false;
        privateKeyFile = config.age.secrets.keys-wireguard-dryborg-privatekey.path;
        address = [ "10.200.200.1/24" ];
        dns = [ "192.168.2.1" ];
        peers = [
          {
            publicKey = "JY5fb0RS7C8WyPPEeymzuMSUeIhDtICGk1FYJgTRnTs=";
            presharedKeyFile = config.age.secrets.keys-wireguard-dryborg-presharedkey.path;
            allowedIPs = [ "0.0.0.0/0" ];
            endpoint = "vpn.dryb.org:53280";
            persistentKeepalive = 21;
          }
        ];
      };
    };
  };
}