{
  roles.default.perInstance = { settings, ... }: {
    nixosModule =
      { config, ... }:
      let
        creds = config.clan.core.vars.generators.gw-router;

        pppInterface = if settings.wan.vlanId == null then settings.wan.interface else "wan-vlan";
      in
      {
        clan.core.vars.generators.gw-router = {
          prompts.pppoe-username = {
            description = "PPPoE username (from the ISP)";
            type = "hidden";
          };
          prompts.pppoe-password = {
            description = "PPPoE password (from the ISP)";
            type = "hidden";
          };
          files."pppoe-username".secret = true;
          files."pppoe-password".secret = true;
          script = ''
            user="$(cat "$prompts"/pppoe-username)"
            pass="$(cat "$prompts"/pppoe-password)"
            printf 'user "%s"\n' "$user" > "$out"/pppoe-username
            printf '"%s" * "%s"\n' "$user" "$pass" > "$out"/pppoe-password
          '';
        };

        services.pppd = {
          enable = true;
          peers.wan = {
            autostart = true;
            config = ''
              plugin pppoe.so ${pppInterface}
              ifname ppp0
              file ${creds.files."pppoe-username".path}
              noipdefault
              defaultroute
              noauth
              hide-password
              persist
              maxfail 0
              holdoff 5
              lcp-echo-interval 15
              lcp-echo-failure 3
              +ipv6
              mtu 1492
              mru 1492
            '';
          };
        };

        environment.etc."ppp/chap-secrets".source = creds.files."pppoe-password".path;
        environment.etc."ppp/pap-secrets".source = creds.files."pppoe-password".path;
      };
  };
}