{ ... }:
{
  _class = "clan.service";
  manifest.name = "gw-router";
  manifest.description = "A gateway router service to configure most of a router features";
  manifest.readme = "A gateway router service to configure most of a router features";
  manifest.categories = [ "System" ];

  roles.default = {
    description = "Site gateway router role";

    interface =
      { lib, config, ... }:
      {
        options = {
          wan = {
            interface = lib.mkOption {
              type = lib.types.str;
              description = "Physical WAN port the PPPoE session runs on.";
            };

            vlanId = lib.mkOption {
              type = lib.types.nullOr (lib.types.ints.between 1 4094);
              default = null;
              description = ''
                802.1Q tag the ISP requires for the PPPoE session (AIS Thailand: 10);
                null for untagged PPPoE directly on the port. Unrelated to the LAN
                VLANs — this tag exists only on the WAN port.
              '';
            };

            macAddress = lib.mkOption {
              type = lib.types.nullOr lib.types.str;
              default = null;
              example = "aa:bb:cc:dd:ee:ff";
              description = ''
                Spoofed MAC for the WAN port, e.g. to keep the MAC the ISP has
                pinned (cloned from the old router). null keeps the hardware MAC.
              '';
            };

            pppInterface = lib.mkOption {
              type = lib.types.str;
              internal = true;
              readOnly = true;
              default = if config.wan.vlanId == null then config.wan.interface else "wan-vlan";
              description = "Interface pppd dials on (the WAN port or its ISP VLAN).";
            };
          };
        };
      };

    perInstance =
      { settings, ... }:
      {
        nixosModule =
          {
            config,
            pkgs,
            lib,
            ...
          }:
          let
          in
          {

            environment.systemPackages = with pkgs; [
              tcpdump
              mtr
              ethtool
              conntrack-tools
              knot-dns
              iftop
              librespeed-cli
            ];

          };
      };
  };

  imports = [ ./pppoe.nix ];
}