{ config, pkgs, lib, ... }:
let
  cfg = config.networking.wireguard.interfaces."wg0";
in {
  networking = {
    nat = {
      enable = true;
      externalInterface = "enp3s0";
      internalInterfaces = [ "wg0" ];
    };
    firewall.allowedUDPPorts = [ cfg.listenPort ];

    wireguard.interfaces."wg0" = {
      ips = [ "10.100.0.1/24" ];
      listenPort = 51820;
      privateKeyFile = "/etc/wireguard/defiant.private";

      peers = [
        { # Burnham
          publicKey = "JcfyrMoZmnbibVLaIKuGSARAX2alFv4kwLbJaLBNbzo=";
          allowedIPs = [
            "10.100.0.2/32"
            # "192.168.11.0/24"
          ];
        }
        { # Sulu
          publicKey = "j6YVekgGS4nhL5zUiOTeK2BVQkYGlTQaiUpwcqQyfRk=";
          allowedIPs = [
            "10.100.0.3/32"
          ];
        }
      ];
    };
  };
}