{
  config,
  pkgs,
  ...
}: let
  hosts = config.cynerd.hosts.spt;
in {
  turris.board = "omnia";
  deploy = {
    enable = true;
    ssh.host = "omnia.spt";
  };

  cynerd = {
    router = {
      enable = true;
      wan = "pppoe-wan";
      lanIP = hosts.omnia;
      staticLeases = {
        "a8:a1:59:10:32:c4" = hosts.errol;
        "7c:b0:c2:bb:9c:ca" = hosts.albert;
        "4c:d5:77:0d:85:d9" = hosts.binky;
        "b8:27:eb:57:a2:31" = hosts.mpd;
        "74:bf:c0:42:82:19" = hosts.printer;
      };
    };
    wifiAP.spt = {
      enable = true;
      ar9287 = {
        interface = "wlp1s0";
        bssids = ["04:f0:21:24:21:93" "08:f0:21:24:21:93"];
        channel = 11;
      };
      qca988x = {
        interface = "wlp3s0";
        bssids = ["04:f0:21:23:16:64" "08:f0:21:23:16:64"];
        channel = 36;
      };
    };
    wireguard = true;
    monitoring.speedtest = true;
  };

  services.journald.extraConfig = ''
    SystemMaxUse=8G
  '';

  environment = {
    etc.crypttab.text = ''
      nas UUID=3472bef9-cbae-48bd-873e-fd4858a0b72f /run/secrets/luks-spt-omnia-nas.key luks
      nassec UUID=016e9e75-bbc8-4b24-8bb7-c800c8f6a500 /run/secrets/luks-spt-omnia-nas.key luks
    '';
    systemPackages = with pkgs; [
      cryptsetup
    ];
  };
  fileSystems = {
    "/data" = {
      device = "/dev/mapper/nas";
      fsType = "btrfs";
      options = ["compress=lzo" "subvol=@data" "nofail"];
    };
    "/srv" = {
      device = "/dev/mapper/nas";
      fsType = "btrfs";
      options = ["compress=lzo" "subvol=@srv" "nofail"];
      depends = ["/data"];
    };
  };
  services.btrfs.autoScrub = {
    enable = true;
    fileSystems = ["/" "/data"];
  };
  services.udev.packages = [
    (pkgs.writeTextFile rec {
      name = "queue_depth_sata.rules";
      destination = "/etc/udev/rules.d/50-${name}";
      text = ''
        SUBSYSTEMS=="pci", DRIVER=="ahci", ATTR{device}!="0x0612", GOTO="turris_pci_end"
        ACTION=="add|change", SUBSYSTEM=="scsi", ATTR{vendor}=="ATA", ATTR{queue_depth}="1"
        LABEL="turris_pci_end"
      '';
    })
  ];

  users = {
    groups.nas = {};
    users = {
      nas = {
        group = "nas";
        openssh.authorizedKeys.keyFiles = [
          (config.personal-secrets + "/unencrypted/nas.pub")
          (config.personal-secrets + "/unencrypted/nas-spt.pub")
        ];
        isNormalUser = true;
        home = "/data/nas";
        homeMode = "770";
      };
      cynerd.extraGroups = ["nas"];
    };
  };
  services.openssh = {
    settings.Macs = ["hmac-sha2-256"]; # Allow sha2-256 for Nexcloud access
    extraConfig = ''
      Match User nas
        X11Forwarding no
        AllowTcpForwarding no
        AllowAgentForwarding no
        ForceCommand internal-sftp -d /data/nas
    '';
  };
  services.fail2ban.enable = true;

  networking.useDHCP = false;
  systemd.network = {
    netdevs = {
      "end2.848" = {
        netdevConfig = {
          Kind = "vlan";
          Name = "end2.848";
        };
        vlanConfig.Id = 848;
      };
    };
    networks = {
      "end2" = {
        matchConfig.Name = "end2";
        networkConfig.VLAN = ["end2.848"];
      };
      "end2.848" = {
        matchConfig.Name = "end2.848";
        networkConfig.BindCarrier = "end2";
      };
      "pppoe-wan" = {
        matchConfig.Name = "pppoe-wan";
        networkConfig = {
          BindCarrier = "end2.848";
          DHCP = "ipv6";
          IPv6AcceptRA = "no";
          DHCPPrefixDelegation = "yes";
          DNS = "1.1.1.1";
        };
        dhcpV6Config = {
          PrefixDelegationHint = "::/56";
          UseDNS = "no";
        };
        dhcpPrefixDelegationConfig = {
          UplinkInterface = ":self";
          SubnetId = 0;
          Announce = "no";
        };
        linkConfig.RequiredForOnline = "routable";
      };
      "lan-brlan" = {
        matchConfig.Name = "lan*";
        networkConfig.Bridge = "brlan";
        bridgeVLANs = [
          {
            EgressUntagged = 1;
            PVID = 1;
          }
          {VLAN = 2;}
        ];
      };
    };
  };

  services.pppd = {
    enable = true;
    peers."wan".config = ''
      plugin pppoe.so end2.848
      ifname pppoe-wan
      lcp-echo-interval 1
      lcp-echo-failure 5
      lcp-echo-adaptive
      defaultroute
      defaultroute6
      #usepeerdns
      maxfail 1
      user metronet
      password metronet
    '';
  };
  systemd.services."pppd-wan".after = ["sys-subsystem-net-devices-end2.848.device"];
  # TODO limit NSS clamping to just pppoe-wan
  networking.firewall.extraForwardRules = ''
    tcp flags syn tcp option maxseg size set rt mtu comment "Needed for PPPoE to fix IPv4"
    iifname {"home", "personalvpn", "wg"} oifname {"home", "personalvpn", "wg"} accept
  '';

  services.syncthing = {
    enable = false;
    openDefaultPorts = true;

    overrideDevices = false;
    overrideFolders = false;

    dataDir = "/data"; # TODO this can't be the location
  };
}