{ ... }:
{
  _class = "clan.service";
  manifest.name = "gw-router";
  manifest.description = "A gateway router service to configure most of a router features";
  manifest.readme = "A gateway router service to configure most of a router features";
  manifest.categories = [ "System" ];

  roles.default = {
    description = "Site gateway router role";

    interface =
      { lib, config, ... }:
      let
        vlanModule =
          { ... }:
          {
            options = {
              id = lib.mkOption {
                type = lib.types.ints.between 1 4094;
                description = "802.1Q VLAN id.";
              };
              address = lib.mkOption {
                type = lib.types.str;
                example = "10.0.10.1";
                description = "Router address on this VLAN.";
              };
              prefixLength = lib.mkOption {
                type = lib.types.ints.between 8 30;
                default = 24;
              };
              subnet = lib.mkOption {
                type = lib.types.str;
                example = "10.0.10.0/24";
                description = "The VLAN's network in CIDR form (must contain `address`).";
              };
              dhcp = {
                enable = lib.mkOption {
                  type = lib.types.bool;
                  default = true;
                };
                pool = {
                  from = lib.mkOption {
                    type = lib.types.str;
                    example = "10.0.10.100";
                  };
                  to = lib.mkOption {
                    type = lib.types.str;
                    example = "10.0.10.199";
                  };
                };
                leaseTime = lib.mkOption {
                  type = lib.types.ints.positive;
                  default = 86400;
                  description = ''
                    Lease validity in seconds. Lower it for high-churn networks,
                    e.g. public-WiFi guest VLANs (3600-7200), so the pool recycles.
                  '';
                };
                fixedIPs = lib.mkOption {
                  type = lib.types.attrsOf (
                    lib.types.submodule {
                      options = {
                        hwAddress = lib.mkOption {
                          type = lib.types.str;
                          example = "aa:bb:cc:dd:ee:ff";
                          description = "Client MAC address.";
                        };
                        ipAddress = lib.mkOption {
                          type = lib.types.str;
                          description = "Fixed address handed to this client (inside the VLAN's subnet, outside the pool).";
                        };
                      };
                    }
                  );
                  default = { };
                  description = "Static DHCP leases; the attribute name becomes the client's hostname.";
                };
              };
              allowWAN = lib.mkOption {
                type = lib.types.bool;
                default = true;
                description = "Whether clients on this VLAN may reach the internet.";
              };
            };
          };
      in
      {
        options = {
          wan = {
            interface = lib.mkOption {
              type = lib.types.str;
              description = "Physical WAN port the PPPoE session runs on.";
            };

            vlanId = lib.mkOption {
              type = lib.types.nullOr (lib.types.ints.between 1 4094);
              default = null;
              description = ''
                802.1Q tag the ISP requires for the PPPoE session (AIS Thailand: 10);
                null for untagged PPPoE directly on the port. Unrelated to the LAN
                VLANs — this tag exists only on the WAN port.
              '';
            };

            macAddress = lib.mkOption {
              type = lib.types.nullOr lib.types.str;
              default = null;
              example = "aa:bb:cc:dd:ee:ff";
              description = ''
                Spoofed MAC for the WAN port, e.g. to keep the MAC the ISP has
                pinned (cloned from the old router). null keeps the hardware MAC.
              '';
            };
          };

          vlans = lib.mkOption {
            type = lib.types.attrsOf (lib.types.submodule vlanModule);
            description = "VLANs setup for this router";
          };

          trunkPorts = lib.mkOption {
            type = lib.types.listOf lib.types.str;
            description = "LAN ports carrying all VLANs tagged (incl. any 10G SFP+ ports).";
          };

          accessPorts = lib.mkOption {
            type = lib.types.attrsOf (
              lib.types.submodule {
                options = {
                  vlanId = lib.mkOption {
                    type = lib.types.int;
                    description = "Untagged traffic in from the device gets tagged VLANs inside the bridge, and VLANs traffic going back out to the device gets untagged, so the device itself never has to know VLANs exist.";
                  };
                };
              }
            );
            description = ''
              Ports acting as untagged access ports on a single VLAN (port name ->
              VLAN id). Frames are untagged on the wire; the bridge tags them with
              the VLAN's PVID. Use for an always-available on-site mgmt port.
            '';
          };

          secondaryUpLink = lib.mkOption { };
        };
      };

    perInstance =
      { settings, ... }:
      {
        nixosModule =
          {
            pkgs,
            lib,
            ...
          }:
          let
            vlanIf = name: "vlan=${name}";
          in
          {

            networking.useNetworkd = true;
            networking.useDHCP = false;
            systemd.network.enable = true;

            systemd.network.netdevs = {
              "20-br0" = {
                netdevConfig = {
                  Name = "br0";
                  Kind = "bridge";
                };
                bridgeConfig = {
                  VLANFiltering = true;
                };
              };
            }
            // lib.optionalAttrs (settings.wan.vlanId != null) {
              "15-wan-lan" = {
                netdevConfig = {
                  Name = "wan-vlan";
                  Kind = "vlan";
                };
                vlanConfig.Id = settings.wan.vlanId;
              };
            }
            // lib.mapAttrs' (
              name: vlan:
              lib.nameValuePair "30-${vlanIf name}" {
                netdevConfig = {
                  Name = vlanIf name;
                  Kind = "vlan";
                };
                vlanConfig.Id = vlan.id;
              }
            ) settings.vlans;

            systemd.network.networks =
              let
                allVLANs = lib.mapAttrsToList (_: vlan: { VLAN = vlan.id; }) settings.vlans;
              in
              {
                "10-wan" = {
                  matchConfig.Name = settings.wan.interface;
                  networkConfig.LinkLocalAddressing = "no";
                  vlan = lib.optional (settings.wan.vlanId != null) "wan-wlan";
                  linkConfig = {
                    RequiredForOnline = "carrier";
                  }
                  // lib.optionalAttrs (settings.wan.macAddress != null) {
                    MACAddress = settings.wan.macAddress;
                  };
                };
              }
              // lib.optionalAttrs (settings.wan.vlanId != null) {
                "15-wan-lan" = {
                  matchConfig.Name = "wan-vlan";
                  networkConfig.LinkLocalAddressing = "no";
                  linkConfig.RequiredForOnline = "no";
                };
              }
              // {
                "20-br0" = {
                  matchConfig.Name = "br0";
                  networkConfig.LinkLocalAddressing = "no";
                  vlan = lib.mapAttrsToList (name: _: vlanIf name) settings.vlans;
                  bridgeVLANs = allVLANs;
                  linkConfig.RequiredForOnline = "no";
                };
              }
              // lib.listToAttrs (
                map (port: {
                  name = "25-trunk-${port}";
                  value = {
                    matchConfig.Name = port;
                    networkConfig.Bridge = "br0";
                    bridgeVLANs = allVLANs;
                    linkConfig.RequiredForOnline = "no";
                  };
                }) settings.trunkPorts
              )
              // lib.mapAttrs' (
                iface: port:
                lib.nameValuePair "25-access-${iface}" {
                  matchConfig.Name = iface;
                  networkConfig.Bridge = "br0";
                  bridgeVLANs = [
                    {
                      VLAN = port.vlanId;
                      PVID = port.vlanId;
                      EgressUntagged = port.vlanId;
                    }
                  ];
                  linkConfig.RequiredForOnline = "no";
                }
              ) settings.accessPorts
              // lib.mapAttrs' (
                name: vlan:
                lib.nameValuePair "40-${vlanIf name}" {
                  matchConfig.Name = vlanIf name;
                  address = [ "${vlan.address}/${toString vlan.prefixLength}" ];
                  networkConfig = {
                    IPv6AcceptRA = false;
                    IPv6SendRA = true;
                    DHCPPrefixDelegation = true;
                  };
                  dhcpPrefixDelegationConfig.SubnetId = "auto";
                  linkConfig.RequiredForOnline = "no";
                }
              ) settings.vlans;

            environment.systemPackages = with pkgs; [
              tcpdump
              mtr
              ethtool
              conntrack-tools
              knot-dns
              iftop
              librespeed-cli
            ];

          };
      };
  };

  imports = [ ./pppoe.nix ];
}